CVE-2023-6968: 
WordPress vulnerability analysis and mitigation

The Moneytizer plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 9.5.20. The vulnerability was disclosed and received the identifier CVE-2023-6968. The issue affects the plugin's AJAX functions due to missing or incorrect nonce validation (NVD).

The vulnerability stems from improper implementation of security controls, specifically the absence or incorrect validation of nonces in multiple AJAX functions. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N according to NVD's assessment. The vulnerability is classified as CWE-352: Cross-Site Request Forgery (NVD).

If exploited, this vulnerability allows unauthenticated attackers to perform various unauthorized actions including updating and retrieving billing and bank details, updating and resetting the plugin's settings, and modifying language settings, along with other lower-severity actions. These actions can be executed if an attacker successfully tricks a site administrator into performing specific actions (NVD).

The vulnerability requires user interaction, specifically requiring an attacker to trick a site administrator into clicking on a malicious link or performing a specific action. The attack vector is network-accessible with low attack complexity (NVD).

The vulnerability has been patched in version 10.0.1 of The Moneytizer plugin. Users are advised to update to this version or later to protect against this security issue (WordPress Plugin).