CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in wptasker WP Discord Post Plus – Supports Unlimited Channels allows Cross Site Request Forgery. This issue affects WP Discord Post Plus – Supports Unlimited Channels: from n/a through 1.0.2.
Explanation of Vulnerability in Simple Terms
WP Discord Post Plus contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated site administrator without their knowledge. The vulnerability affects versions up to 1.0.2. An attacker can craft a malicious webpage that, when visited by a logged-in admin, triggers unwanted changes to the plugin's Discord integration settings or configuration.
What an attacker can do
Perform unauthorized actions on the site by tricking an admin into visiting a malicious webpage.
Potential impact on your site
An attacker can modify Discord integration settings or trigger unintended plugin actions without admin consent.
Conditions required to exploit
Site admin must be logged in and visit an attacker-controlled webpage; no special privileges required.
Key dates
External resources
Related vulnerabilities
