CVE-2023-6501 – Splashscreen <= 0.20 - Settings Update via CSRF

https://notcve.org/view.php?id=CVE-2023-6501

The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack El complemento Splashscreen de WordPress hasta la versión 0.20 no tiene activada la verificación CSRF al actualizar su configuración, lo que podría permitir a los atacantes hacer que un administrador que haya iniciado sesión los cambie mediante un ataque CSRF. The Splashscreen plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 0.20. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to update the plugin's settings granted they can trick a site administrator into performing an action such as clicking on a link. • https://magos-securitas.com/txt/CVE-2023-6501.txt https://wpscan.com/vulnerability/dd19189b-de04-44b6-8ac9-0c32399a8976 • CWE-352: Cross-Site Request Forgery (CSRF) •