Birdseed
Monthly
Cross-Site Request Forgery in the BirdSeed WordPress plugin (all versions up to and including 2.2.0) enables unauthenticated remote attackers to overwrite the plugin's API token by tricking an authenticated site administrator into clicking a crafted link. The vulnerability stems from birdseed_plugin_settings_page() accepting the birdseed_token GET parameter and persisting it via update_option() with no nonce verification, bypassing WordPress's standard CSRF protection entirely. No public exploit has been identified at time of analysis; CVSS rates this Medium (4.3) reflecting narrow integrity impact limited to token replacement.
Cross-Site Request Forgery in the BirdSeed WordPress plugin (all versions up to and including 2.2.0) enables unauthenticated remote attackers to overwrite the plugin's API token by tricking an authenticated site administrator into clicking a crafted link. The vulnerability stems from birdseed_plugin_settings_page() accepting the birdseed_token GET parameter and persisting it via update_option() with no nonce verification, bypassing WordPress's standard CSRF protection entirely. No public exploit has been identified at time of analysis; CVSS rates this Medium (4.3) reflecting narrow integrity impact limited to token replacement.