CVE-2023-4935

Summary

CVE-2023-4935 is a Cross-Site Request Forgery (CSRF) vulnerability affecting versions up to 1.1.3.3 of the BEAR for WordPress plugin. The issue stems from insufficient nonce validation on the create_profile function, enabling unauthenticated attackers to craft malicious requests and manipulate site administrators into executing those requests, ultimately leading to the creation of profiles without proper authorization. This vulnerability poses a significant risk, as attackers can exploit it to gain unauthorized access and control over WordPress sites using this plugin. Administrators are advised to update the plugin to the latest version as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.