The Last.fm Recent Album Artwork plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This vulnerability arises from missing or incorrect nonce validation on the ‘lastfm_albums_artwork.php’ page. As a result, unauthenticated attackers can update settings and inject malicious web scripts via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2025-7684 |
Exploitation
To exploit this vulnerability, an attacker must trick a site administrator into clicking a malicious link that sends a forged request to the vulnerable ‘lastfm_albums_artwork.php’ page. This can be achieved through social engineering tactics, such as phishing emails or misleading messages that prompt the administrator to perform an action that triggers the exploit.
Affected Products
- Last.fm Recent Album Artwork plugin for WordPress: A plugin that displays recent album artwork from Last.fm on WordPress sites, vulnerable to CSRF attacks.
Mitigation
To mitigate this vulnerability, it is recommended to update the Last.fm Recent Album Artwork plugin to the latest version that includes proper nonce validation. Additionally, site administrators should be cautious about clicking on links from untrusted sources and consider implementing additional security measures such as web application firewalls.