Notify Odoo
Monthly
The Notify Odoo WordPress plugin up to version 1.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the _updateSettings function that allows unauthenticated attackers to modify critical plugin configuration-including the Notify Odoo URL, notification settings, tracking image configuration, and allowed IP addresses-by tricking site administrators into clicking a malicious link. The vulnerability requires user interaction (administrator action) but poses a direct integrity risk by enabling attackers to redirect plugin functionality to attacker-controlled servers or disable legitimate notification and tracking features.
The Notify Odoo WordPress plugin up to version 1.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the _updateSettings function that allows unauthenticated attackers to modify critical plugin configuration-including the Notify Odoo URL, notification settings, tracking image configuration, and allowed IP addresses-by tricking site administrators into clicking a malicious link. The vulnerability requires user interaction (administrator action) but poses a direct integrity risk by enabling attackers to redirect plugin functionality to attacker-controlled servers or disable legitimate notification and tracking features.