CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. This is due to missing or incorrect nonce validation on the fourty_slider_options_page function. This makes it possible for unauthenticated attackers to modify plugin slider-page configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
Lobot Slider Administrator versions 0.6.0 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by an authenticated administrator, performs unwanted actions on the slider without the admin's knowledge. The vulnerability requires the admin to visit a malicious link while logged in.
What an attacker can do
Perform unwanted actions on the slider by tricking an authenticated admin into visiting a malicious webpage.
Potential impact on your site
An attacker can modify slider settings or content if they trick your admin into clicking a malicious link while logged in.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage or link.
Key dates
External resources
Related vulnerabilities
