CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Sanjeev Mohindra Author Box Plugin With Different Description author-box-with-different-description allows Cross Site Request Forgery.This issue affects Author Box Plugin With Different Description: from n/a through <= 1.3.5.
Explanation of Vulnerability in Simple Terms
The Author Box Plugin With Different Description for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 1.3.5. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the plugin without the admin's knowledge or consent. The vulnerability requires user interaction and does not expose sensitive data, but can modify site content or settings.
What an attacker can do
Trick a logged-in admin into performing unwanted actions on the plugin via a malicious webpage.
Potential impact on your site
Unauthorized changes to author box settings or content if an admin visits a malicious link while logged in.
Conditions required to exploit
Admin must visit attacker's webpage while logged into WordPress. No special plugin configuration required.
Key dates
External resources
