CVE-2023-3254

Summary

CVE-2023-3254 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Widgets for Google Reviews plugin for WordPress. Versions up to and including 10.9 are at risk. The issue arises due to missing or incorrect nonce validation within the file setup_no_reg_header.php. Consequently, unauthenticated attackers can manipulate administrators into clicking malicious links, allowing the attacker to reset plugin settings and delete reviews, exploiting the CSRF weakness.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.