CVE-2023-1028: WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'setIgnore'
The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the setIgnore function. This makes it possible for unauthenticated attackers to update plugin options via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-1028?
CVE-2023-1028 is a vulnerability found in the WP Meta SEO plugin for WordPress versions up to 4.5.3 that allows unauthenticated attackers to update plugin options via a forged request.
How severe is CVE-2023-1028?
CVE-2023-1028 has a severity rating of medium with a CVSS score of 4.3.
How does CVE-2023-1028 impact WordPress sites using the WP Meta SEO plugin?
CVE-2023-1028 allows unauthenticated attackers to manipulate plugin options, which could potentially lead to unauthorized changes to the site's SEO settings and metadata.
Is there a fix for CVE-2023-1028?
Yes, the vulnerability has been addressed in version 4.5.4 of the WP Meta SEO plugin. It is recommended to update to the latest version to mitigate the risk.
Where can I find more information about CVE-2023-1028?
You can find more information about CVE-2023-1028 on the official WordPress plugins trac page and the Wordfence threat intelligence database.