Course Redirects for LearnDash WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Course Redirects for LearnDash plugin for WordPress, affecting all versions up to and including 0.4. The vulnerability arises from inadequate nonce validation in form submissions on the settings page, allowing unauthenticated attackers to alter plugin settings by sending a forged request that tricks a site administrator into clicking a link.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in plugin settings, potentially allowing attackers to manipulate course redirect behaviors or associated data.