CVE-2023-6501: 
WordPress vulnerability analysis and mitigation

The Splashscreen WordPress plugin through version 0.20 contains a Cross-Site Request Forgery (CSRF) vulnerability. The vulnerability was discovered in the plugin's settings update functionality, where it lacks proper CSRF protection checks. This security issue was publicly disclosed on January 19, 2024 (WPScan).

The vulnerability stems from the absence of CSRF protection mechanisms when updating the plugin's settings. It has been assigned a CVSS score of 4.3 (Medium) and is classified under CWE-352. The vulnerability falls under the OWASP Top 10 category A2: Broken Authentication and Session Management (WPScan).

When exploited, this vulnerability could allow attackers to modify the plugin's settings through a CSRF attack, provided they can trick an authenticated administrator into triggering the malicious request. The impact is limited to the plugin's configuration settings (NVD, WPScan).

A proof of concept exploit has been documented using a simple JavaScript command: document.forms[0].submit(). The attack requires an authenticated administrator to interact with a malicious page while logged into the WordPress dashboard (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the Splashscreen plugin version 0.20 or earlier should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).