Dashboard Notes
Monthly
Cross-site request forgery in the WordPress plugin Dashboard Notes (MIGHTYminnow) affects all versions through 1.0.3, letting an attacker craft a page or link that silently rides an authenticated privileged user's session to perform state-changing plugin actions. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) reflects that the attacker needs no server-side authentication (PR:N) but must successfully lure a logged-in user with access to the plugin's dashboard functionality into interacting with attacker-controlled content (UI:R); exploitation cannot occur without that victim action. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and the universal applicability of CSRF to unpatched WordPress plugins keep the practical risk meaningful for sites running 1.0.3 or earlier.
Cross-site request forgery in the WordPress plugin Dashboard Notes (MIGHTYminnow) affects all versions through 1.0.3, letting an attacker craft a page or link that silently rides an authenticated privileged user's session to perform state-changing plugin actions. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) reflects that the attacker needs no server-side authentication (PR:N) but must successfully lure a logged-in user with access to the plugin's dashboard functionality into interacting with attacker-controlled content (UI:R); exploitation cannot occur without that victim action. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and the universal applicability of CSRF to unpatched WordPress plugins keep the practical risk meaningful for sites running 1.0.3 or earlier.