Word Balloon < 4.20.3 - Avatar Removal via CSRF
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.3%
exploitation probability
0.3%top 79% of all CVEs
observed exploitation
nono source reports it
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
Affected products
Unknown · Word Balloon