ShopSite WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the ShopSite plugin for WordPress, affecting all versions through 1.5.10. The vulnerability arises from inadequate nonce validation, allowing unauthenticated attackers to manipulate settings and inject harmful scripts by tricking an administrator into clicking a link.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in plugin settings and the injection of malicious scripts, which could be executed in the context of the user.

Reproduction

To reproduce this vulnerability, an attacker must craft a request that exploits the missing nonce validation. This request can be sent to a WordPress site with the vulnerable ShopSite plugin, targeting an administrator's session. The attacker must persuade the administrator to click a link or perform an action that triggers the forged request, thereby bypassing the intended security measures.

Remediation

Users are advised to update the ShopSite WordPress plugin to version 1.5.11 or later.