Gtbabel WordPress Plugin Unauthenticated Cookie Theft Vulnerability

A vulnerability exists in the Gtbabel WordPress plugin in versions prior to 6.6.9. The issue arises because the plugin does not verify that the URL for code analysis belongs to the user's blog. This flaw could enable unauthenticated attackers to steal cookies from logged-in users, including administrators, by having them open a malicious URL. The analysis request would then inadvertently include those cookies.

Impact

Exploitation of this vulnerability could lead to unauthorized access to a user's session, allowing an attacker to impersonate the user, such as an admin.