PT-2025-27846 · WordPress · Ycontributors
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
yContributors plugin for WordPress versions up to, and including, 0.5
Description:
The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'yContributors' page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing a specific action, such as clicking on a link.
Recommendations:
For yContributors plugin for WordPress versions up to, and including, 0.5, consider disabling the plugin until a patch is available to prevent exploitation.
Restrict access to the 'yContributors' page to minimize the risk of exploitation.
Avoid performing actions that could be triggered by a forged request, such as clicking on links from untrusted sources, until the issue is resolved.
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ycontributors