CVE-2023-4246: GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givesendwpremoteinstallhandler function. This makes it possible for unauthenticated attackers to install and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4246?
CVE-2023-4246 is considered a medium-severity vulnerability due to its potential impact on unauthorized plugin installation and activation.
How do I fix CVE-2023-4246?
To fix CVE-2023-4246, update the GiveWP plugin to version 2.34 or later, which includes proper nonce validation.
Who is affected by CVE-2023-4246?
CVE-2023-4246 affects users of the GiveWP plugin for WordPress running any version up to and including 2.33.3.
What type of vulnerability is CVE-2023-4246?
CVE-2023-4246 is classified as a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce validation.
Can CVE-2023-4246 be exploited by unauthenticated users?
Yes, CVE-2023-4246 can be exploited by unauthenticated attackers, allowing them to install and activate plugins.