The Linux Promotional Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.4. This vulnerability arises from missing or incorrect nonce validation on the ‘inux-promotional-plugin.php’ page. As a result, unauthenticated attackers can update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2025-7668 |
Exploitation
To exploit this vulnerability, an attacker must trick a site administrator into clicking a malicious link that sends a forged request to the ‘inux-promotional-plugin.php’ page. This can be achieved through social engineering tactics, such as phishing emails or misleading messages, which prompt the administrator to perform actions that would trigger the vulnerability.
Affected Products
- Linux Promotional Plugin: A WordPress plugin that allows for promotional features but is vulnerable to CSRF attacks in versions up to 1.4.
Mitigation
To mitigate this vulnerability, it is recommended to update the Linux Promotional Plugin to the latest version where nonce validation has been properly implemented. Additionally, site administrators should be cautious of unsolicited links and ensure that they are not performing actions on their WordPress site without verifying the source.