CVE-2023-3720
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Upload Media By URL WordPress plugin before version 1.0.8 lacks CSRF checks when uploading files. This could allow attackers to force logged-in admins to upload files, including HTML containing JS code, on their behalf.
Risk Assessment
The lack of CSRF verification poses a risk that attackers could exploit admin privileges to upload malicious files, potentially leading to serious security breaches.
Recommendation
It is recommended to update the plugin to version 1.0.8 or later to mitigate this vulnerability.
Original NVD description (English source)
The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf.