The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which could allow attackers to make logged in users perform such action via a CSRF attack
El complemento de WordPress Community by PeepSo anterior a 6.3.1.2 no tiene verificación CSRF al crear una publicación de usuario (visible en su muro en su página de perfil), lo que podría permitir a los atacantes hacer que los usuarios que han iniciado sesión realicen dicha acción a través de un ataque CSRF.
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.3.1.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to create user posts on other members walls via a forged request granted they can trick a sites' user into performing an action such as clicking on a link. CVE-2024-31251 appears to be a potential duplicate of this issue.
