Redux Framework, debaa4ac59d89352be34fbf13b9dfa0438587692

CVE, Research URL: debaa4ac59d89352be34fbf13b9dfa0438587692
Home page URL: Security reports for Redux Framework
Application: Redux Framework
Published on: Dec 15, 2020
Research Description: Redux Framework [redux-framework] < 4.1.24 Gutenberg Template Library & Redux Framework <= 4.1.23 - Cross-Site Request Forgery The Gutenberg Template Library & Redux Framework plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.1.23. This is due to incorrect nonce validation in the 'Redux AJAX Save' class. This makes it possible for unauthenticated attackers to update the plugin's settings granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 4.1.24.
Status: vulnerable