PT-2023-24217 · WordPress · Wp Sticky Social
Shunsuke Aoki
·
Published
2023-06-20
·
Updated
2023-06-29
·
CVE-2023-3320
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
WP Sticky Social plugin for WordPress versions up to, and including, 1.0.1
Description
The issue is due to missing nonce validation in the ~/admin/views/admin.php file, making it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request. This can be achieved if an attacker can trick a site administrator into performing an action, such as clicking on a link.
Recommendations
For WP Sticky Social plugin for WordPress versions up to, and including, 1.0.1, consider disabling the plugin until a patch is available to prevent modification of the plugin's settings and injection of malicious web scripts. Restrict access to the ~/admin/views/admin.php file to minimize the risk of exploitation. Avoid performing actions that could be triggered by a forged request, such as clicking on links from untrusted sources, until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wp Sticky Social