Travelpayouts WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Travelpayouts WordPress plugin, affecting versions prior to 1.1.13. The vulnerability arises because the plugin does not implement CSRF protection when importing settings from version 1. This lack of validation could enable attackers to manipulate a logged-in admin's settings through a CSRF attack.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the settings of a logged-in admin user.

Remediation

Users can update to Travelpayouts WordPress Plugin version 1.1.13 or later to address this vulnerability.