CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in wpmediadownload Media Library File Download media-download allows Cross Site Request Forgery.This issue affects Media Library File Download: from n/a through <= 1.4.
Explanation of Vulnerability in Simple Terms
The Media Library File Download plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 1.4. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the administrator's knowledge or consent. The vulnerability requires user interaction and does not expose sensitive data, but can result in unauthorized modifications.
What an attacker can do
Trick a logged-in admin into performing unwanted actions via a malicious webpage.
Potential impact on your site
Administrators could unknowingly perform actions on your site if they visit a malicious link while logged in.
Conditions required to exploit
Admin must visit attacker's webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
