8.8

CVE-2023-6391

Exploit

Custom User CSS <= 0.2 - Settings Update via CSRF

Custom User CSS <= 0.2 - Cross-Site Request Forgery to Settings Update

The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Mögliche Gegenmaßnahme
Custom User CSS: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jeremiahorem ≫ Custom User Css HwPlatformwordpress Version <= 0.2
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Custom User CSS
Version *-0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.265
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

https://magos-securitas.com/txt/CVE-2023-6391.txt
Exploit
https://wpscan.com/vulnerability/4098b18d-6ff3-462c-af05-48adb6599cf3/
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/6b53ed24-2821-440f-9aba-69d75b7459a3
Third Party Advisory