CVE-2023-5006

WP Discord Invite < 2.5.1 - Arbitrary Settings Update via CSRF

Medium · published January 17, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in administrator to submit a crafted request.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.5th percentile
Published
2024-01-17T14:31Z
EPSS history
Timeline
  • 17 JAN 14:31Z
    WP Discord Invite < 2.5.1 - Arbitrary Settings Update via CSRF
    cvelistv5