Not rated
CVE-2023-5884 The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an…
Description
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Word Balloon 4.20 | earliest → < 4.20.3 | 4.20.3 |