EKC Tournament Manager WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the EKC Tournament Manager WordPress plugin, affecting versions prior to 2.2.2. The vulnerability arises because the plugin does not implement CSRF protection when updating settings. This lack of validation could enable attackers to exploit logged-in administrators by forcing them to unintentionally change settings.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the plugin's settings by a logged-in admin.

Remediation

Users are advised to update the EKC Tournament Manager WordPress plugin to version 2.2.2 or later.