CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
Yougler Blogger Profile Page versions up to v1.01 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on their behalf. The vulnerability requires user interaction—the admin must click the link or visit the attacker's page. Impact is limited to data modification; no data theft or availability loss occurs.
What an attacker can do
Trick a logged-in admin into performing unwanted actions (like changing settings or creating content) by visiting a malicious link.
Potential impact on your site
An attacker could modify site settings or content if they trick an admin into clicking a crafted link while logged in.
Conditions required to exploit
Admin must be logged in and click a malicious link or visit an attacker-controlled page.
Key dates
External resources
