WordPress WP Hide Post Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF)

Vulnerability

The WP Hide Post plugin for WordPress versions 2.0.10 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability. The plugin does not properly verify nonces or other CSRF tokens, allowing an attacker to trick an authenticated administrator into unknowingly executing unwanted actions on the plugin's settings or functionality. The plugin has been closed and removed from the WordPress.org plugin directory due to a security issue, and no patched version is available.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious link or form that, when clicked by an authenticated WordPress administrator while logged into the admin panel, triggers a forged request to the vulnerable plugin endpoint. No special network position is required; the attacker simply needs to host the malicious payload and induce the victim to interact with it, typically through social engineering (e.g., a deceptive email or webpage). The attacker does not need to authenticate to the WordPress site, as the exploit relies on the victim's existing session.

Impact

Successful exploitation allows an attacker to perform any action that the victim administrator can perform on the WP Hide Post plugin, such as hiding/unhiding posts or modifying plugin settings. The impact is limited to the plugin's functionality; however, if the plugin has privileged operations (e.g., modifying post visibility), the attacker could disrupt content management. The scope is within the WordPress admin interface, and the attacker does not gain direct access to the server or other components.

Mitigation

No patched version is available. The plugin has been removed from the WordPress.org repository as of July 27, 2023, and users are strongly advised to uninstall the plugin immediately. There is no known workaround other than removing the plugin. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication. [1]