CVE-2023-0766

Summary

CVE-2023-0766 is a vulnerability affecting the Newsletter Popup plugin for WordPress. The issue lies in the plugin's lack of Cross-Site Request Forgery (CSRF) checks in certain areas. This weakness enables attackers to manipulate logged-in users into performing unintended actions, such as making changes to their account settings or other functionalities. Specifically, the wp_newsletter_show_localrecord page is unprotected by a nonce, leaving it susceptible to CSRF attacks. Users are advised to update their Newsletter Popup plugin to a version that addresses this issue to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.