CVE-2023-7048: 
WordPress vulnerability analysis and mitigation

The My Sticky Bar plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2023-7048) affecting all versions up to and including 2.6.6. The vulnerability was disclosed on January 11, 2024, and impacts the mystickymenu-contact-leads.php file (NVD).

The vulnerability stems from missing or incorrect nonce validation in mystickymenu-contact-leads.php. It has received a CVSS v3.1 base score of 4.3 (MEDIUM) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, while Wordfence assessed it with a score of 3.1 (LOW) and vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows unauthenticated attackers to trigger the export of a CSV file containing contact leads. The exported CSV file is temporarily stored in a public location and can be accessed during a brief window before it is automatically deleted by the export function (NVD).

A patch has been released to address this vulnerability. Site administrators should update the My Sticky Bar plugin to a version newer than 2.6.6 (Wordpress Patch).