WordPress Memory Usage Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Memory Usage plugin for WordPress, affecting all versions through 3.98. The issue arises from a lack of nonce validation in the 'wpmemory_install_plugin' function, allowing unauthenticated attackers to secretly install whitelisted plugins by tricking a site administrator into clicking a link.

Impact

Exploitation of this vulnerability could lead to unauthorized installation of plugins, which could potentially be malicious or harmful.

Reproduction

To reproduce this vulnerability, an attacker must craft a request that exploits the missing nonce validation in the 'wpmemory_install_plugin' function. This request should include the 'slug' of a whitelisted plugin and be sent to the WordPress site while tricking an administrator into clicking a link that initiates the request.

Remediation

Users are advised to update the Memory Usage plugin to version 3.99 or later.