CVE-2023-28419 WordPress Force First and Last Name as Display Name Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)
An attacker can trick users into modifying their display name settings via CSRF in this WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-28419?
CVE-2023-28419 is a medium-severity vulnerability in Stranger Studios Force First and Last Name as Display Name, published on 12 Nov 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-Site Request Forgery (CSRF) vulnerability in Stranger Studios Force First and Last Name as Display Name plugin <= 1.2 versions.
Weakness: CWE-352
Which versions are affected by CVE-2023-28419?
It affects 1 product.
Products include Strangerstudios Force Display Name.
How do I fix CVE-2023-28419?
No fix has been published for CVE-2023-28419 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-28419 being exploited?
There is no known exploitation of CVE-2023-28419 in the wild and no public exploit code.
Sources
Also known as GHSA-3gm2-64xq-8fp3.