Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the WP Global Screen Options plugin for WordPress, affecting all versions up to and including 0.2. It occurs because the plugin's updatewpglobalscreenoptions action handler lacks nonce validation, allowing an attacker to trick an administrator into performing an unwanted action, such as clicking a malicious link, which then modifies global screen options for all users.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this vulnerability to change global screen options for all users by tricking an administrator into executing a forged request. While it does not allow direct data theft or system compromise, it can lead to unauthorized changes in the user interface or settings, potentially disrupting normal operations or causing confusion among users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update or remove the WP Global Screen Options plugin if it is at version 0.2 or earlier. Additionally, ensure that administrators are cautious about clicking on untrusted links to avoid being tricked into performing actions that could exploit this vulnerability.

Useful 0 Not Useful 0