Apptivo Business Site CRM Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Apptivo Business Site CRM plugin for WordPress, affecting all versions through 5.3. The issue arises from inadequate nonce validation on the 'awp_ip_deny' page, allowing unauthenticated attackers to block IP addresses by sending a forged request, provided they can persuade a site administrator to click a link.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, where an attacker can trick a user into performing actions they did not intend to, potentially leading to unauthorized changes or actions on the user's behalf.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.