CVE-2021-34632: 
WordPress vulnerability analysis and mitigation

The SEO Backlinks WordPress plugin (versions up to and including 4.0.1) was identified with a Cross-Site Request Forgery vulnerability (CVE-2021-34632). The vulnerability was discovered by Takahiro Yamashita and was publicly disclosed on July 28, 2021. The security flaw exists in the loc_config function within the ~/seo-backlinks.php file (WPScan).

The vulnerability has been assigned a CVSS score of 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The security issue is classified as CWE-352, allowing attackers to perform Cross-Site Request Forgery attacks that can lead to stored Cross-Site Scripting (XSS) (Wordfence, WPScan).

The vulnerability allows attackers to inject arbitrary web scripts through CSRF attacks. This could potentially lead to the execution of malicious JavaScript code in users' browsers, potentially compromising sensitive information or performing unauthorized actions on behalf of authenticated users (WPScan).

The vulnerability requires user interaction (UI:R in CVSS vector) but no privileges (PR:N) and can be exploited over the network (AV:N). A proof of concept exploit has been documented, demonstrating the possibility of executing arbitrary JavaScript code through CSRF attacks (WPScan).

As of the vulnerability disclosure, there is no known fix available for this security issue. Users of the SEO Backlinks WordPress plugin version 4.0.1 or lower should consider removing or disabling the plugin until a security patch is released (WPScan).