Cross-Site Request Forgery in WpMobi WordPress Plugin

Executive Summary

The WpMobi plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 0.0.3. This occurs because the plugin does not properly validate nonces in the handleSaveGeneralSettings function. As a result, an attacker can trick a site administrator into performing an action, such as clicking a malicious link, which allows the attacker to modify the plugin's General Settings.

Additionally, the vulnerability allows injection of arbitrary web scripts into the administrator's browser through the unescaped app_name attribute. This script executes even if the app_name value fails validation and is not saved to the database, because the form re-renders with the attacker-supplied value in memory during validation failure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an unauthenticated attacker to modify the plugin's settings without your consent. This could lead to unauthorized changes in your WordPress site's configuration.

Moreover, the attacker can inject malicious scripts into the administrator's browser, potentially leading to further attacks such as session hijacking, phishing, or other malicious activities executed in the context of the administrator's session.

Useful 0 Not Useful 0