Cross-site request forgery in wordpress responsive thumbnail carousel slider - CVE-2023-5821

Vulnerability details

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the deleteselected function. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Affected software

How to mitigate CVE-2023-5821

External References

• https://plugins.trac.wordpress.org/changeset/1263536/wp-responsive-slider-with-lightbox/trunk/wp-responsive-slider-with-lightbox.php
• https://wordpress.org/plugins/wp-responsive-thumbnail-slider
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bde75c5a-b0b7-4f26-91e9-dd4816e276c9?source=cve

Related Security Bulletins

• Cross-site request forgery in Thumbnail carousel slider plugin for WordPress