Disable Auto Updates WordPress Plugin Cross-Site Request Forgery Vulnerability
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Disable Auto Updates plugin for WordPress, affecting all versions through 1.4. The issue arises from inadequate nonce validation on the 'disable-auto-updates' page, allowing unauthenticated attackers to disable auto updates by sending a forged request, provided they can persuade a site administrator to click a link.
Impact
Exploitation of this vulnerability allows for Cross-Site Request Forgery, where an attacker can trick a user into performing actions they did not intend to, potentially leading to the disabling of automatic updates on the WordPress site.
Remediation
No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.