WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action
mediumThe WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to missing or incorrect nonce validation on the handleSaveGeneralSettings function. This makes it possible for unauthenticated attackers to modify the plugin's General Settings and inject...
- CVSS:
- 4.3
- Affected:
- up to 0.0.3
- Fix:
- No patched version reported
- Disclosed:
- Jun 8, 2026