CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The wp Time Machine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.0. This is due to missing or incorrect nonce validation on the 'wpTimeMachineCore.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
wp Time Machine versions 3.4.0 and earlier contain a cross-site scripting vulnerability. An attacker can inject malicious scripts that execute in a victim's browser when they visit a crafted page. The vulnerability requires user interaction and affects the integrity and confidentiality of site data. Update to a version newer than 3.4.0 to resolve this issue.
What an attacker can do
Inject malicious scripts that run in a victim's browser and steal data or perform actions on their behalf.
Potential impact on your site
Site visitors can be tricked into running attacker-controlled code, risking credential theft or unauthorized actions.
Conditions required to exploit
Victim must visit a page containing the attacker's malicious link or content; no authentication required.
Key dates
External resources
Related vulnerabilities
