RateMyAgent Official WordPress Plugin Cross-Site Request Forgery Vulnerability
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability exists in the RateMyAgent Official plugin for WordPress, affecting all versions through 1.4.0. The issue arises from inadequate nonce validation on the 'rma-settings-wizard', allowing unauthenticated attackers to change the plugin's API key by sending a forged request, provided they can persuade a site administrator to click a link.
Impact
Exploitation of this vulnerability allows for Cross-Site Request Forgery, enabling attackers to manipulate the plugin's API key settings.
Remediation
Users can update to version 1.5.0 or a newer patched version to address this vulnerability.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.