WP-BibTeX Plugin for WordPress Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WP-BibTeX plugin for WordPress, affecting all versions through 3.0.1. The vulnerability arises from inadequate nonce validation in the wp_bibtex_option_page() function, allowing unauthenticated attackers to inject malicious scripts via a forged request, provided they can persuade a site administrator to click a link or perform a similar action.

Impact

Exploitation of this vulnerability could lead to Cross-Site Scripting (XSS) attacks, both stored and reflected, according to Wordfence.

Remediation

Users can update to WP-BibTeX version 3.0.2 or a newer patched version to address this vulnerability.