Non notée
CVE-2023-5884 The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an…
Description
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Word Balloon 4.20 | premières → < 4.20.3 | 4.20.3 |