PixelYourSite WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the PixelYourSite WordPress plugin, specifically in versions through 11.1.2. The issue arises from inadequate nonce validation in the adminEnableGdprAjax() function, allowing unauthenticated attackers to alter GDPR settings by sending a forged request, provided they can persuade a site administrator to click a link or perform a similar action.

Impact

Exploitation of this vulnerability allows for unauthorized modification of GDPR settings by tricking an administrator into performing an action that triggers the vulnerable function.

Remediation

Users are advised to update the PixelYourSite WordPress plugin to version 11.1.3 or a later patched version.