CVE-2023-6326: Master Slider - Responsive Touch Slider <= 3.9.10 - Cross-Site Request Forgery via process_bulk_action
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.10. This is due to missing or incorrect nonce validation on the 'processbulkaction' function. This makes it possible for unauthenticated attackers to duplicate or delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-50900 and CVE-2024-6490 may be a duplicate of this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6326?
CVE-2023-6326 has a medium severity rating due to its potential impact on WordPress sites using the Master Slider plugin.
How do I fix CVE-2023-6326?
To fix CVE-2023-6326, update the Master Slider plugin to version 3.10.0 or later.
Who is affected by CVE-2023-6326?
CVE-2023-6326 affects all versions of the Master Slider plugin for WordPress up to and including version 3.9.3.
What type of vulnerability is CVE-2023-6326?
CVE-2023-6326 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
Can CVE-2023-6326 be exploited by unauthenticated users?
Yes, CVE-2023-6326 can be exploited by unauthenticated attackers due to the lack of proper nonce validation.