Executive Summary

The Genzel breadcrumbs plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.2. This occurs because the plugin's _options_page function lacks proper nonce validation. As a result, an attacker can trick a site administrator into performing an action, such as clicking a malicious link, which allows the attacker to update the plugin's breadcrumb configuration without authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to modify the breadcrumb settings of the plugin by tricking an administrator into executing a forged request. The attacker can change templates, delimiters, home labels, home URIs, and breadcrumb rules. While it does not directly compromise confidentiality or availability, it can lead to unauthorized changes in site navigation which may confuse users or be used as part of a broader attack.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update the Genzel breadcrumbs plugin for WordPress to a version later than 1.2 where the nonce validation issue in the _options_page function is fixed.

Additionally, ensure that site administrators are cautious about clicking on untrusted links to avoid being tricked into performing unintended actions.

Useful 0 Not Useful 0