Advanced Database Cleaner WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Advanced Database Cleaner plugin for WordPress, affecting all versions through 3.1.6. The issue arises from inadequate nonce validation in the aDBc_prepare_elements_to_clean() function, allowing unauthenticated attackers to manipulate the 'keep last' setting. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the plugin's settings, specifically the 'keep last' option, which could disrupt the intended functionality of the database cleaning process.

Remediation

Users are advised to update the Advanced Database Cleaner plugin to version 3.1.7 or a newer patched version.