Executive Summary

The vulnerability exists in the WordPress plugin "Disable Admin Notices – Hide Dashboard Notifications" in all versions up to and including 1.4.2. It is a Cross-Site Request Forgery (CSRF) issue caused by missing nonce validation in the function `showPageContent()`. This flaw allows an unauthenticated attacker to add arbitrary URLs to the plugin's blocked redirects list by tricking a site administrator into performing an action, such as clicking a malicious link.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to manipulate the list of blocked redirects in the WordPress admin dashboard without proper authorization. By adding arbitrary URLs to the blocked redirects list, the attacker could interfere with the normal operation of the site’s admin interface, potentially blocking legitimate redirects or causing confusion for administrators. Since the attacker must trick an admin into clicking a link, it relies on social engineering but does not require the attacker to be authenticated.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Cross-Site Request Forgery (CSRF) in the Disable Admin Notices – Hide Dashboard Notifications WordPress plugin up to version 1.4.2, due to missing nonce validation in the showPageContent() function.

Detection on your system can involve checking if the plugin Disable Admin Notices is installed and running a vulnerable version (up to and including 1.4.2).

Since the vulnerability allows unauthenticated attackers to add arbitrary URLs to the blocked redirects list via forged requests, you can inspect the blocked redirects list in the plugin settings for unexpected or suspicious URLs.

Commands to detect this vulnerability specifically are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, the primary step is to update the Disable Admin Notices plugin to a version later than 1.4.2 where nonce validation has been added to prevent CSRF attacks.

If an immediate update is not possible, restrict access to the WordPress admin dashboard to trusted users only, as the attack requires tricking an administrator into performing an action.

Additionally, review and clean the blocked redirects list in the plugin settings to remove any unauthorized URLs that may have been added.

Useful 0 Not Useful 0