Trust Payments Gateway (3DS2) <= 1.2.2 - Cross-Site Request Forgery
Strategic Overview
<= 1.2.2N/AVulnerability Overview
The Trust Payments Gateway (3DS2) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missing nonce validation on several functions like tpgw_create_new_user() and tpgw_update_address_myst(). This makes it possible for unauthenticated attackers to perform several different administrative actions via forged requests granted they can trick a site administrator into performing an action such as clicking on a link.
Technical Analysis
REMEDIATION: Update to version 1.2.3, or a newer patched version --- IDENTIFIER: CWE-352 (Cross-Site Request Forgery (CSRF)) The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C