Polylang, c5bd994f7837548ecf9b537df00ade21990080ce

CVE, Research URL: c5bd994f7837548ecf9b537df00ade21990080ce
Home page URL: Security reports for Polylang
Application: Polylang
Published on: Jan 16, 2019
Research Description: Polylang [polylang] < 2.5.1 Polylang <= 2.5 - Cross-Site Request Forgery The Polylang plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5. This is due to missing or incorrect nonce validation on the wp_insert_post_data() function. This makes it possible for unauthenticated attackers to duplicate media via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 2.5.1.
Status: vulnerable