Foxtool All-in-One WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Foxtool All-in-One WordPress plugin, specifically in versions through 2.5.2. The issue arises from inadequate nonce validation in the 'foxtool_login_google' function, allowing unauthenticated attackers to manipulate OAuth connections by tricking site administrators into clicking a link.

Impact

Exploitation of this vulnerability could lead to unauthorized OAuth connections being established, potentially allowing attackers to gain access to user information or perform actions on behalf of the user.

Remediation

Users can update to version 2.5.3 or a newer patched version to address this vulnerability.