CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The Like & Share My Site plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the 'lsms_admin' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
Like & Share My Site versions 0.2 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction—the admin must visit the attacker's page while authenticated. Impact is limited to low-level data changes.
What an attacker can do
Trick a logged-in admin into performing unwanted actions on the site by visiting a malicious webpage.
Potential impact on your site
Administrators could unknowingly modify site settings or data if tricked into visiting a malicious link while logged in.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage; no special privileges required.
Key dates
External resources
Related vulnerabilities
