CVE-2023-4209
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The POEditor WordPress plugin before 0.9.8 lacks CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted actions, such as resetting the plugin's settings and updating its API key.
Risk Assessment
The lack of proper protections may lead to unauthorized changes in the plugin's configuration, jeopardizing the integrity of the system and data.
Recommendation
It is recommended to update the POEditor plugin to version 0.9.8 or newer to minimize the risk of CSRF attacks.
Original NVD description (English source)
The POEditor WordPress plugin before 0.9.8 does not have CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted actions, such as reset the plugin's settings and update its API key via CSRF attacks.