Smash Balloon Social Photo Feed – Best Social Feed Plugin for WordPress, cff60996de18d96c853c179f6dd70c33a7a6fa31
- CVE, Research URL
- Home page URL
-
Security reports for Smash Balloon Social Photo Feed – Best Social Feed Plugin for WordPress
- Published on
- Mar 05, 2019
- Research Description
- Smash Balloon Social Photo Feed – Easy Social Feeds Plugin [instagram-feed] < 1.12 Smash Balloon Social Photo Feed <= 1.11.3 - Cross-Site Request Forgery to Back-Up Deletion The Smash Balloon Social Photo Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.3. This is due to missing or incorrect nonce validation on the sbi_clear_backups() function. This makes it possible for unauthenticated attackers to clear the plugins back-ups via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 1.12.
- Status
-
vulnerable