Homerunner
Monthly
Cross-Site Request Forgery in Homerunner for WordPress allows unauthenticated attackers to update plugin settings if they can trick a site administrator into performing an action like clicking a link. The vulnerability stems from missing nonce validation in the main_settings() function, affecting all versions up to 1.0.29. Exploitation requires user interaction and no public exploit or active exploitation is currently known.
Cross-Site Request Forgery in Homerunner for WordPress allows unauthenticated attackers to update plugin settings if they can trick a site administrator into performing an action like clicking a link. The vulnerability stems from missing nonce validation in the main_settings() function, affecting all versions up to 1.0.29. Exploitation requires user interaction and no public exploit or active exploitation is currently known.