ThePerfectWedding.nl Widget WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the ThePerfectWedding.nl Widget plugin for WordPress, affecting all versions through 2.8. The vulnerability arises from inadequate nonce validation in the 'update_option' function, allowing unauthenticated attackers to manipulate the 'tpwKey' option. This can be achieved by injecting stored cross-site scripting through a forged request, provided the attacker can persuade a site administrator to click a link or perform a similar action.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, leading to stored Cross-Site Scripting. This means that an attacker can inject malicious scripts that are executed in the context of the user who is affected, potentially leading to session hijacking or other malicious actions.

Remediation

Users are advised to update the ThePerfectWedding.nl Widget plugin to version 2.9 or later.