CVE-2023-5884

Word Balloon < 4.20.3 - Avatar Removal via CSRF

published December 4, 2023

CVSS
—
EPSS
0%
Percentile
22.5
In the wild
Unconfirmed
What it is

The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00309 · 22.5th percentile
Published
2023-12-04T21:29Z
EPSS history
Timeline
  • 04 DEC 21:29Z
    Word Balloon < 4.20.3 - Avatar Removal via CSRF
    cvelistv5