EUVD-2026-14182
GHSA-37g4-qqqv-7m99
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. This is due to missing or incorrect nonce validation on the fourty_slider_options_page function. This makes it possible for unauthenticated attackers to modify plugin slider-page configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
The Lobot Slider Administrator WordPress plugin (versions up to 0.6.0) contains a Cross-Site Request Forgery (CSRF) vulnerability in the fourty_slider_options_page function due to missing or incorrect nonce validation. This allows unauthenticated attackers to modify plugin slider-page configuration by tricking site administrators into clicking malicious links, potentially altering slider settings and website presentation. The vulnerability carries a moderate CVSS score of 4.3 with low attack complexity, requiring only user interaction and no privileges.
Technical ContextAI
This vulnerability exploits a fundamental web security weakness classified as CWE-352 (Cross-Site Request Forgery), where state-changing operations lack proper anti-CSRF token validation. The Lobot Slider Administrator plugin (CPE: cpe:2.3:a:chuckmo:lobot_slider_administrator:*:*:*:*:*:*:*:*) implements a WordPress admin function (fourty_slider_options_page) that processes slider configuration changes without verifying WordPress security nonces—cryptographic tokens that ensure requests originate from legitimate admin sessions. WordPress nonces are the standard CSRF mitigation mechanism for plugins; their absence or improper implementation in capability-restricted pages permits arbitrary modification of plugin settings through forged cross-origin requests. The vulnerability affects the plugin's core administrative interface as evidenced by the plugin file itself (lobot-slider-administrator.php) referenced in the WordPress plugin repository at lines indicating the vulnerable function.
RemediationAI
Site administrators must upgrade the Lobot Slider Administrator plugin to a version after 0.6.0 that includes proper nonce validation in the fourty_slider_options_page function; check the WordPress plugin repository or vendor release notes for patched versions. If a patched version is unavailable or the plugin is abandoned, disable and remove the plugin entirely, as CSRF vulnerabilities in low-maintenance plugins cannot be safely mitigated through access controls alone. As a temporary workaround pending plugin removal, restrict administrative access to the slider configuration pages by implementing IP allowlisting on the WordPress admin interface via firewall or .htaccess rules, and educate administrators to avoid clicking suspicious links while logged into WordPress. Verify plugin status at https://plugins.trac.wordpress.org/browser/lobot-slider-administrator/ for any available updates or security notices.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today