Envo Extra, 4370a080274d0696a00c0cf989f84692dbe2e074

CVE, Research URL: 4370a080274d0696a00c0cf989f84692dbe2e074
Home page URL: Security reports for Envo Extra
Application: Envo Extra
Published on: Oct 17, 2023
Research Description: Envo Extra [envo-extra] < 1.8.4 Envo Extra <= 1.8.3 - Cross-Site Request Forgery The Envo Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.3. This is due to missing or incorrect nonce validation on the ajax_required_plugins_activate function. This makes it possible for unauthenticated attackers to activate plugins required by Envo Extra via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: Min -, max 1.8.4.
Status: vulnerable