CVE-2023-6196
CVSS 3.1 Score 8.8 of 10 (high)
Details
Summary
CVE-2023-6196 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Audio Merchant plugin for WordPress. Versions up to and including 5.0.4 are impacted. The issue stems from inadequate or missing nonce validation within the function audio_merchant_add_audio_file. This flaw enables unauthenticated attackers to manipulate administrators into executing malicious actions, such as uploading arbitrary files via crafted links. Successful exploitation of this vulnerability could lead to serious security consequences. It is strongly advised to update the plugin to a patched version as soon as possible to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions