CVE-2022-40219 – WordPress FavIcon Switcher plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability

https://notcve.org/view.php?id=CVE-2022-40219

Cross-Site Request Forgery (CSRF) vulnerability in SedLex FavIcon Switcher plugin <= 1.2.11 at WordPress allows plugin settings change. Una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el plugin SedLex FavIcon Switcher versiones anteriores a 1.2.11 incluyéndola en WordPress, que permite cambiar la configuración del plugin The FavIcon Switcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.11. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/favicon-switcher/wordpress-favicon-switcher-plugin-1-2-11-cross-site-request-forgery-csrf-vulnerability https://wordpress.org/plugins/favicon-switcher • CWE-352: Cross-Site Request Forgery (CSRF) •