CyberRota Analysis
AI-GeneratedThe FuseWP plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce verification in the toggle_sync_status() function, affecting all versions up to 1.1.24.2. This vulnerability allows unauthenticated attackers to manipulate sync rule statuses by tricking site administrators into executing malicious requests. WordPress site administrators using this plugin should prioritize applying updates to mitigate potential exploitation risks.
Original NVD Description
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the toggle_sync_status() function. This makes it possible for unauthenticated attackers to toggle the status of sync rules (enable/disable) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.