EKC Tournament Manager WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the EKC Tournament Manager WordPress plugin, affecting versions prior to 2.2.2. The vulnerability arises because the plugin does not implement CSRF protection when updating settings. This lack of validation could enable attackers to manipulate settings of a logged-in admin.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the settings of the affected WordPress plugin, potentially allowing for further exploitation or manipulation of tournament management features.