Add Google Social Profiles to Knowledge Graph Box WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Add Google Social Profiles to Knowledge Graph Box plugin for WordPress, affecting all versions through 1.0. The vulnerability arises from a lack of nonce validation in the settings update process, allowing unauthenticated attackers to manipulate the plugin's Knowledge Graph settings. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

Impact

Exploitation of this vulnerability allows for unauthorized changes to the plugin's settings, which could potentially be used to manipulate how social profiles are displayed in Google's Knowledge Graph.