CVE-2023-4247: GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givesendwpdisconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4247?
CVE-2023-4247 is classified as a medium severity vulnerability due to the potential for unauthenticated actions leading to plugin deactivation.
How do I fix CVE-2023-4247?
To fix CVE-2023-4247, update the GiveWP plugin to version 2.33.4 or later immediately.
What types of attacks are possible with CVE-2023-4247?
CVE-2023-4247 allows unauthenticated attackers to exploit missing nonce validation to deactivate the SendWP plugin.
Which versions of the GiveWP plugin are affected by CVE-2023-4247?
CVE-2023-4247 affects all versions of the GiveWP plugin up to and including version 2.33.3.
Is user authentication required to exploit CVE-2023-4247?
No, CVE-2023-4247 can be exploited by unauthenticated users, making it particularly concerning.