CVE-2023-2405: CSRF
First published: Sat Jun 03 2023(Updated: )
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6.2. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vcita CRM and Lead Management | <=2.6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-2405.
What is the severity rating of CVE-2023-2405?
CVE-2023-2405 has a severity rating of medium.
What is the affected software for CVE-2023-2405?
The affected software for CVE-2023-2405 is the CRM and Lead Management by vcita plugin for WordPress versions up to and including 2.6.2.
What is the cause of CVE-2023-2405?
CVE-2023-2405 is caused by missing nonce validation in the vcita-callback.php file of the CRM and Lead Management by vcita plugin for WordPress.
How can unauthenticated attackers exploit CVE-2023-2405?
Unauthenticated attackers can exploit CVE-2023-2405 to modify the plugin's settings.
- collector/nvd-latest
- agent/softwarecombine
- agent/type
- agent/weakness
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/vcita
- canonical/vcita crm and lead management
- version/vcita crm and lead management/2.6.2