CVE-2023-5884 — Word Balloon < 4.20.3 - Avatar Removal via CSRF
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to dele…
Published: 2023-12-04 · CVSS: Unscored
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7