CVE-2023-2279: WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, modify or delete Directory Kit related posts and terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Partial patches were made avilable in versions 1.2.0 and 1.2.1 but the issue was not fully patched until 1.2.2
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2279?
CVE-2023-2279 is considered to be a medium severity vulnerability due to its potential for exploitation by unauthenticated attackers.
How do I fix CVE-2023-2279?
To fix CVE-2023-2279, update the WP Directory Kit plugin to version 1.2.2 or later where the nonce validation issue has been addressed.
Who is affected by CVE-2023-2279?
CVE-2023-2279 affects all versions of the WP Directory Kit plugin for WordPress up to and including version 1.2.1.
What type of vulnerability is CVE-2023-2279?
CVE-2023-2279 is a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthorized changes to the plugin by attackers.
What function contains the vulnerability in CVE-2023-2279?
The vulnerability in CVE-2023-2279 is located in the 'admin_page_display' function due to missing or incorrect nonce validation.