CVE-2023-5006

Description

The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in administrator to submit a crafted request.

Reserved 2023-09-15 | Published 2024-01-17 | Updated 2024-10-21 | Assigner WPScan

Problem types

CWE-352 Cross-Site Request Forgery (CSRF)

Product status

Default status
unaffected

Any version before 2.5.1
affected

Credits

Enrico Marcolini finder

Claudio Marchesini finder

WPScan coordinator

References

wpscan.com/...erability/d29bcc1c-241b-4867-a0c8-4ae5f9d1c8e8 exploit vdb-entry technical-description

cve.org (CVE-2023-5006)

nvd.nist.gov (CVE-2023-5006)

Download JSON