Executive Summary

The MotorDesk plugin for WordPress has a vulnerability known as Cross-Site Request Forgery (CSRF) in all versions up to and including 1.1.2.

This vulnerability exists because the plugin's motordesk_admin_home function lacks proper nonce validation, which is a security measure to verify legitimate requests.

As a result, an attacker can trick a site administrator into performing an action, such as clicking a malicious link, which then allows the attacker to update the plugin's configuration settings without authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an unauthenticated attacker to change important configuration settings of the MotorDesk plugin, such as the search page URI and the custom template directory path.

Because these settings control how the plugin behaves and displays content, unauthorized changes could disrupt website functionality or be used to redirect users to malicious pages.

The attack requires tricking a site administrator into performing an action, so social engineering is involved.

Useful 0 Not Useful 0