Textp2P Texting Widget
Monthly
Cross-site request forgery in TextP2P Texting Widget plugin for WordPress up to version 1.7 allows unauthenticated attackers to modify all plugin settings including API credentials and widget configuration by tricking site administrators into clicking a malicious link. The vulnerability stems from missing nonce validation in the settings update handler, enabling attackers to change chat titles, messages, colors, reCAPTCHA configuration, and other sensitive options without authentication or authorization verification. This requires user interaction (admin must click attacker-controlled link) but affects any WordPress site running the vulnerable plugin with an active administrator.
Cross-site request forgery in TextP2P Texting Widget plugin for WordPress up to version 1.7 allows unauthenticated attackers to modify all plugin settings including API credentials and widget configuration by tricking site administrators into clicking a malicious link. The vulnerability stems from missing nonce validation in the settings update handler, enabling attackers to change chat titles, messages, colors, reCAPTCHA configuration, and other sensitive options without authentication or authorization verification. This requires user interaction (admin must click attacker-controlled link) but affects any WordPress site running the vulnerable plugin with an active administrator.