Vulnerability DatabaseCVE-2023-7074

CVE-2023-7074:
WordPress vulnerability analysis and mitigation

Overview

The WP SOCIAL BOOKMARK MENU WordPress plugin through version 1.2 contains a Cross-Site Request Forgery (CSRF) vulnerability, identified as CVE-2023-7074. The vulnerability was discovered on December 11, 2022, and publicly disclosed on January 3, 2024. This security issue affects the plugin's settings update functionality, potentially impacting WordPress installations using this plugin (WPScan).

Technical details

The vulnerability stems from the absence of CSRF protection mechanisms when updating the plugin's settings. The issue is classified as CWE-352 (Cross-Site Request Forgery) and has received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. A simple proof of concept exploit has been documented using the JavaScript command 'document.forms[0].submit();' (NVD, WPScan).

Impact

When successfully exploited, this vulnerability allows attackers to modify the plugin's settings through a CSRF attack, provided they can trick an authenticated administrator into triggering the malicious request. This could lead to unauthorized changes in the plugin's configuration (WPScan).

Mitigation and workarounds

Currently, there is no known fix available for this vulnerability. Users of the WP SOCIAL BOOKMARK MENU plugin should consider implementing additional security measures or evaluating alternative solutions until a patch is released (WPScan).