CVE-2021-20851: 
WordPress vulnerability analysis and mitigation

Cross-site request forgery (CSRF) vulnerability was discovered in Browser and Operating System Finder WordPress plugin versions prior to 1.2. The vulnerability allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors (JVN Report, WPScan).

The plugin lacks proper authorization and CSRF checks when saving its settings, allowing unauthenticated users to update them. This could also lead to Stored XSS due to the lack of sanitization and escaping. While version 1.2 added a CSRF check, it was still missing capability checks. The vulnerability has been assigned a CVSS score of 8.3 (high) (WPScan).

If exploited, an attacker could perform unintended operations when an administrator views a malicious page while logged in. Additionally, the vulnerability could allow unauthenticated users to update plugin settings, which could also lead to Stored XSS attacks (JVN Report, WPScan).

Users are advised to update the plugin to version 1.2 or later according to the information provided by the developer. As of May 18, 2022, the plugin has been closed and is no longer available for download due to security issues (WordPress Plugin).