CVE-2021-20782: 
WordPress vulnerability analysis and mitigation

Cross-site request forgery (CSRF) vulnerability was discovered in Software License Manager plugin versions prior to 4.4.6. The vulnerability was identified on July 8, 2021, with CVE identifier CVE-2021-20782. The affected software is the WordPress Plugin 'Software License Manager' provided by Tips and Tricks HQ (JVN Advisory).

The vulnerability stems from the plugin's lack of CSRF protection on its settings page and insufficient sanitization when outputting user input. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is classified as CWE-352 (Cross-Site Request Forgery) (NVD, WPScan).

If exploited, attackers could potentially manipulate an authenticated administrator into performing unintended operations on the plugin's settings page. The vulnerability could also allow attackers to inject XSS payloads into the plugin's settings when an administrator views a malicious page while logged in (WPScan, JVN Advisory).

The vulnerability requires user interaction, specifically requiring an administrator to be logged in and to view a malicious page. The attack complexity is considered low, requiring no privileges for exploitation (NVD).

The vulnerability has been patched in version 4.4.6 of the Software License Manager plugin. Users are advised to update to this version or later to protect against potential CSRF attacks. The fix includes added sanitization and nonce checks for the settings interface (WordPress Plugin).