Fast & Fancy Filter – 3F WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Fast & Fancy Filter – 3F WordPress plugin, affecting versions through 1.2.2. The vulnerability arises from a lack of nonce verification in the 'saveFields' function, which processes the 'fff_save_settins' AJAX action. This omission allows unauthenticated attackers to manipulate plugin filter settings, alter arbitrary options, or create new filter posts by sending a forged request, provided they can deceive a site administrator into clicking a link.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of plugin settings and the creation of new filter posts.