WordPress Youtube SpeedLoad Plugin <= 0.6.3 is vulnerable to Cross Site Request Forgery (CSRF)

Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the YouTube SpeedLoad plugin for WordPress, affecting versions 0.6.3 and earlier [1]. The vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions without their consent.

Exploitation

To exploit this vulnerability, an attacker must craft a malicious link or page that triggers a cross-site request when visited by an authenticated administrator. The attacker does not need authentication but relies on the victim's active session. The exact actions that can be triggered are not detailed in the available references, but CSRF typically enables modification of plugin settings or other administrative functions.

Impact

Successful exploitation allows an attacker to perform actions on behalf of the administrator, potentially leading to unauthorized changes in plugin configuration, privilege escalation, or other unintended operations. The full scope of impact is limited by the plugin's capabilities and the victim's privileges.

Mitigation

The plugin has been closed and removed from the WordPress.org plugin directory as of March 7, 2024 due to a security issue [1]. No patched version is available. Users should uninstall the plugin immediately and replace it with an alternative. No official workaround has been provided.