CVE-2023-1028 — Cross-Site Request Forgery in WP Meta SEO

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 74.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Joomunited WP Meta SEO
Timeline
PublishedFeb 28

Description

The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the setIgnore function. This makes it possible for unauthenticated attackers to update plugin options via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5joomunited/wp_meta_seo4.5.3

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'setIgnore'↗2023-02-28
▶
GHSA
GHSA-jcr4-843q-3v56: The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4↗2023-02-28
▶
CVE-2023-1028 — Cross-Site Request Forgery | cvebase