CVE-2023-5884
Word Balloon < 4.20.3 - Avatar Removal via CSRF
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
Affected products
Unknown · Word BalloonWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →