CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Cross Site Request Forgery.This issue affects Integrate Google Drive: from n/a through <= 1.5.2.
Explanation of Vulnerability in Simple Terms
The Integrate Google Drive plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 1.5.2. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction but does not require authentication from the attacker.
What an attacker can do
Trick a logged-in admin into performing unwanted actions via a malicious webpage.
Potential impact on your site
Attackers can modify plugin settings or perform other admin actions if an admin visits a malicious link.
Conditions required to exploit
Admin must visit attacker-controlled page while logged into WordPress.
Key dates
External resources
