{"id":19220,"date":"2025-04-07T17:15:48","date_gmt":"2025-04-07T17:15:48","guid":{"rendered":""},"modified":"2025-06-24T17:20:20","modified_gmt":"2025-06-24T23:20:20","slug":"cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/","title":{"rendered":"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs&#8217; Planetarium WordPress Plugin"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Vulnerability Summary<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE ID:<\/strong> CVE-2023-6532<\/li>\n\n\n\n<li><strong>Severity:<\/strong> High (CVSS 3.1 Score: 8.8)<\/li>\n\n\n\n<li><strong>Attack Vector:<\/strong> <a class=\"wpil_keyword_link\" href=\"https:\/\/www.ameeba.com\"   title=\"Network\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"24327\">Network<\/a><\/li>\n\n\n\n<li><strong>Privileges Required:<\/strong> None<\/li>\n\n\n\n<li><strong>User Interaction:<\/strong> Required<\/li>\n\n\n\n<li><strong>Impact:<\/strong> Potential unauthorized changes to plugin settings via <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-50932-csrf-attack-on-savignano-s-notify-for-confluence\/\"  data-wpil-monitor-id=\"33548\">CSRF attack<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Affected Products<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Product<\/th><th>Affected Versions<\/th><\/tr><\/thead><tbody><tr><td>WP Blogs&#8217; Planetarium <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-6140-arbitrary-file-upload-vulnerability-in-essential-real-estate-wordpress-plugin\/\"  data-wpil-monitor-id=\"24577\">WordPress Plugin<\/a><\/td><td>Versions \u2264 1.0<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How the Exploit Works<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The WP Blogs&#8217; Planetarium plugin lacks proper <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-50930-cross-site-request-forgery-csrf-in-savignano-s-notify-leading-to-configuration-tampering-and-potential-data-leakage\/\"  data-wpil-monitor-id=\"31985\">Cross-Site Request Forgery<\/a> (CSRF) checks when updating its settings. An attacker can <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-47992-critical-buffer-overflow-vulnerability-exploit-in-freeimage-library\/\"  data-wpil-monitor-id=\"25597\">exploit this vulnerability<\/a> by tricking a logged-in administrator into clicking a malicious link or visiting a crafted webpage. This action could result in unauthorized changes to the plugin&#8217;s settings without the administrator&#8217;s knowledge or consent.\u200b<a href=\"https:\/\/www.rainforest.tech\/cves\/CVE-2023-6532.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">NVD+2Rainforest Technologies+2GitHub+2<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Conceptual Example Code<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An attacker might <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-24189-memory-corruption-vulnerability-due-to-maliciously-crafted-web-content-in-various-operating-systems\/\"  data-wpil-monitor-id=\"61183\">craft a malicious<\/a> HTML page as follows:\u200b<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">htmlCopyEdit<code>&lt;html&gt;\n  &lt;body onload=\"document.forms[0].submit()\"&gt;\n    &lt;form action=\"https:\/\/victim-site.com\/wp-admin\/admin-post.php\" method=\"POST\"&gt;\n      &lt;input type=\"hidden\" name=\"action\" value=\"update_planetarium_settings\"&gt;\n      &lt;input type=\"hidden\" name=\"setting1\" value=\"malicious_value\"&gt;\n      &lt;!-- Additional hidden fields as required --&gt;\n    &lt;\/form&gt;\n  &lt;\/body&gt;\n&lt;\/html&gt;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">When the administrator visits this page while logged in, the form auto-submits, sending a POST request to the vulnerable plugin <a class=\"wpil_keyword_link\" href=\"https:\/\/ameeba.com\"   title=\"endpoint\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"24328\">endpoint<\/a>, thereby altering its settings.\u200b<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Potential Risks<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-2815-unauthorized-modification-of-data-in-administrator-z-wordpress-plugin\/\"  data-wpil-monitor-id=\"29777\">Unauthorized modification<\/a> of plugin settings\u200b<\/li>\n\n\n\n<li>Potential <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-3529-sensitive-information-exposure-in-wordpress-simple-shopping-cart-plugin\/\"  data-wpil-monitor-id=\"42054\">exposure of sensitive<\/a> information\u200b<\/li>\n\n\n\n<li>Disruption of website functionality\u200b<a href=\"https:\/\/www.rainforest.tech\/cves\/CVE-2023-6532.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">Rainforest Technologies+1NVD+1<\/a><\/li>\n\n\n\n<li>Foundation for further attacks exploiting altered configurations\u200b<a href=\"https:\/\/www.rainforest.tech\/cves\/CVE-2023-6532.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">Rainforest Technologies<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mitigation Recommendations<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Update the Plugin:<\/strong> If an updated version is available, apply the patch that addresses this vulnerability.\u200b<\/li>\n\n\n\n<li><strong>Implement CSRF Protection:<\/strong> Ensure that all form submissions include nonces or tokens to validate legitimate requests.\u200b<\/li>\n\n\n\n<li><strong>Educate Administrators:<\/strong> Advise administrators to avoid clicking on suspicious links or visiting untrusted websites while logged into the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-3211-unauthenticated-sql-injection-vulnerability-in-wordpress-database-administrator-plugin\/\"  data-wpil-monitor-id=\"29973\">WordPress<\/a> admin panel.\u200b<\/li>\n\n\n\n<li><strong>Use Security Plugins:<\/strong> Employ WordPress security plugins that offer CSRF protection and monitor for suspicious activities.\u200b<a href=\"https:\/\/www.rainforest.tech\/cves\/CVE-2023-6532.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">Rainforest Technologies<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Conclusion<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2023-6532 highlights the importance of implementing proper <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-41661-unauthenticated-remote-command-execution-vulnerability-due-to-csrf-in-main-web-interface\/\"  data-wpil-monitor-id=\"61182\">CSRF protections in web<\/a> applications. The <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-2005-critical-vulnerability-in-the-wordpress-plugin-front-end-users-feup\/\"  data-wpil-monitor-id=\"26011\">vulnerability in the WP Blogs&#8217; Planetarium plugin<\/a> allows attackers to manipulate plugin settings through crafted requests, posing significant risks to website integrity. Administrators should promptly apply available patches and adhere to best security practices to mitigate such threats.\u200b<a href=\"https:\/\/github.com\/advisories\/GHSA-6xcx-h3hh-6q6h?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">Rainforest Technologies+2GitHub+2NVD+2<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>References<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a class=\"\" href=\"https:\/\/www.rainforest.tech\/cves\/CVE-2023-6532.html\">Rainforest Technologies \u2013 CVE-2023-6532<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a class=\"\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-6532\">NVD \u2013 CVE-2023-6532<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a class=\"\" href=\"https:\/\/wpscan.com\/vulnerability\/05a730bc-2d72-49e3-a608-e4390b19e97f\">WPScan Advisory<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a class=\"\" href=\"https:\/\/github.com\/advisories\/GHSA-6xcx-h3hh-6q6h\">GitHub Advisory Database<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Vulnerability Summary Affected Products Product Affected Versions WP Blogs&#8217; Planetarium WordPress Plugin Versions \u2264 1.0 How the Exploit Works The WP Blogs&#8217; Planetarium plugin lacks proper Cross-Site Request Forgery (CSRF) checks when updating its settings. An attacker can exploit this vulnerability by tricking a logged-in administrator into clicking a malicious link or visiting a crafted [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[79],"product":[],"attack_vector":[90],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-19220","post","type-post","status-publish","format-standard","hentry","category-uncategorized","vendor-github","attack_vector-csrf"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"Vulnerability Summary CVE ID: CVE-2023-6532 Severity: High (CVSS 3.1 Score: 8.8) Attack Vector: Network Privileges Required: None User Interaction: Required Impact: Potential unauthorized changes to plugin settings via CSRF attack Affected Products How the Exploit Works The WP Blogs&#039; Planetarium plugin lacks proper Cross-Site Request Forgery (CSRF) checks when updating its settings. An attacker can\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Ameeba\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Ameeba Blog - Your Guide to a Safer Digital World.\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs\u2019 Planetarium WordPress Plugin - Ameeba Blog\" \/>\n\t\t<meta property=\"og:description\" content=\"Vulnerability Summary CVE ID: CVE-2023-6532 Severity: High (CVSS 3.1 Score: 8.8) Attack Vector: Network Privileges Required: None User Interaction: Required Impact: Potential unauthorized changes to plugin settings via CSRF attack Affected Products How the Exploit Works The WP Blogs&#039; Planetarium plugin lacks proper Cross-Site Request Forgery (CSRF) checks when updating its settings. An attacker can\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-04-07T17:15:48+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-06-24T23:20:20+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs\u2019 Planetarium WordPress Plugin - Ameeba Blog\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Vulnerability Summary CVE ID: CVE-2023-6532 Severity: High (CVSS 3.1 Score: 8.8) Attack Vector: Network Privileges Required: None User Interaction: Required Impact: Potential unauthorized changes to plugin settings via CSRF attack Affected Products How the Exploit Works The WP Blogs&#039; Planetarium plugin lacks proper Cross-Site Request Forgery (CSRF) checks when updating its settings. An attacker can\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/#blogposting\",\"name\":\"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs\\u2019 Planetarium WordPress Plugin - Ameeba Blog\",\"headline\":\"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs&#8217; Planetarium WordPress Plugin\",\"author\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/image-5.png\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#articleImage\"},\"datePublished\":\"2025-04-07T17:15:48+00:00\",\"dateModified\":\"2025-06-24T17:20:20+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/#webpage\"},\"articleSection\":\"Uncategorized, Github, Csrf\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"name\":\"Uncategorized\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"position\":2,\"name\":\"Uncategorized\",\"item\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/#listItem\",\"name\":\"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs&#8217; Planetarium WordPress Plugin\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/#listItem\",\"position\":3,\"name\":\"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs&#8217; Planetarium WordPress Plugin\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"name\":\"Uncategorized\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#organization\",\"name\":\"Ameeba Blog\",\"description\":\"Your Guide to a Safer Digital World.\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/image-5.png\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/\",\"name\":\"Ameeba\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ead225eeac23a6207666b4137a84523c6b550501a7ee49c81559ebd727825560?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Ameeba\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/#webpage\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/\",\"name\":\"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs\\u2019 Planetarium WordPress Plugin - Ameeba Blog\",\"description\":\"Vulnerability Summary CVE ID: CVE-2023-6532 Severity: High (CVSS 3.1 Score: 8.8) Attack Vector: Network Privileges Required: None User Interaction: Required Impact: Potential unauthorized changes to plugin settings via CSRF attack Affected Products How the Exploit Works The WP Blogs' Planetarium plugin lacks proper Cross-Site Request Forgery (CSRF) checks when updating its settings. An attacker can\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\"},\"datePublished\":\"2025-04-07T17:15:48+00:00\",\"dateModified\":\"2025-06-24T17:20:20+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/\",\"name\":\"Ameeba Blog\",\"description\":\"Your Guide to a Safer Digital World.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs\u2019 Planetarium WordPress Plugin - Ameeba Blog","description":"Vulnerability Summary CVE ID: CVE-2023-6532 Severity: High (CVSS 3.1 Score: 8.8) Attack Vector: Network Privileges Required: None User Interaction: Required Impact: Potential unauthorized changes to plugin settings via CSRF attack Affected Products How the Exploit Works The WP Blogs' Planetarium plugin lacks proper Cross-Site Request Forgery (CSRF) checks when updating its settings. An attacker can","canonical_url":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/#blogposting","name":"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs\u2019 Planetarium WordPress Plugin - Ameeba Blog","headline":"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs&#8217; Planetarium WordPress Plugin","author":{"@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author"},"publisher":{"@id":"https:\/\/www.ameeba.com\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","@id":"https:\/\/www.ameeba.com\/blog\/#articleImage"},"datePublished":"2025-04-07T17:15:48+00:00","dateModified":"2025-06-24T17:20:20+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/#webpage"},"isPartOf":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/#webpage"},"articleSection":"Uncategorized, Github, Csrf"},{"@type":"BreadcrumbList","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/#listItem","position":1,"name":"Home","item":"https:\/\/www.ameeba.com\/blog\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/#listItem","name":"Uncategorized"}},{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/#listItem","position":2,"name":"Uncategorized","item":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/#listItem","name":"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs&#8217; Planetarium WordPress Plugin"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/#listItem","position":3,"name":"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs&#8217; Planetarium WordPress Plugin","previousItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/#listItem","name":"Uncategorized"}}]},{"@type":"Organization","@id":"https:\/\/www.ameeba.com\/blog\/#organization","name":"Ameeba Blog","description":"Your Guide to a Safer Digital World.","url":"https:\/\/www.ameeba.com\/blog\/","logo":{"@type":"ImageObject","url":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/#organizationLogo"},"image":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author","url":"https:\/\/www.ameeba.com\/blog\/author\/admin\/","name":"Ameeba","image":{"@type":"ImageObject","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/ead225eeac23a6207666b4137a84523c6b550501a7ee49c81559ebd727825560?s=96&d=mm&r=g","width":96,"height":96,"caption":"Ameeba"}},{"@type":"WebPage","@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/#webpage","url":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/","name":"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs\u2019 Planetarium WordPress Plugin - Ameeba Blog","description":"Vulnerability Summary CVE ID: CVE-2023-6532 Severity: High (CVSS 3.1 Score: 8.8) Attack Vector: Network Privileges Required: None User Interaction: Required Impact: Potential unauthorized changes to plugin settings via CSRF attack Affected Products How the Exploit Works The WP Blogs' Planetarium plugin lacks proper Cross-Site Request Forgery (CSRF) checks when updating its settings. An attacker can","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.ameeba.com\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/#breadcrumblist"},"author":{"@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author"},"creator":{"@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author"},"datePublished":"2025-04-07T17:15:48+00:00","dateModified":"2025-06-24T17:20:20+00:00"},{"@type":"WebSite","@id":"https:\/\/www.ameeba.com\/blog\/#website","url":"https:\/\/www.ameeba.com\/blog\/","name":"Ameeba Blog","description":"Your Guide to a Safer Digital World.","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.ameeba.com\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"Ameeba Blog - Your Guide to a Safer Digital World.","og:type":"article","og:title":"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs\u2019 Planetarium WordPress Plugin - Ameeba Blog","og:description":"Vulnerability Summary CVE ID: CVE-2023-6532 Severity: High (CVSS 3.1 Score: 8.8) Attack Vector: Network Privileges Required: None User Interaction: Required Impact: Potential unauthorized changes to plugin settings via CSRF attack Affected Products How the Exploit Works The WP Blogs' Planetarium plugin lacks proper Cross-Site Request Forgery (CSRF) checks when updating its settings. An attacker can","og:url":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/","og:image":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","og:image:secure_url":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","article:published_time":"2025-04-07T17:15:48+00:00","article:modified_time":"2025-06-24T23:20:20+00:00","twitter:card":"summary_large_image","twitter:title":"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs\u2019 Planetarium WordPress Plugin - Ameeba Blog","twitter:description":"Vulnerability Summary CVE ID: CVE-2023-6532 Severity: High (CVSS 3.1 Score: 8.8) Attack Vector: Network Privileges Required: None User Interaction: Required Impact: Potential unauthorized changes to plugin settings via CSRF attack Affected Products How the Exploit Works The WP Blogs' Planetarium plugin lacks proper Cross-Site Request Forgery (CSRF) checks when updating its settings. An attacker can","twitter:image":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png"},"aioseo_meta_data":{"post_id":"19220","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"created":"2025-04-07 17:18:17","updated":"2026-04-05 12:11:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ameeba.com\/blog\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/\" title=\"Uncategorized\">Uncategorized<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tCVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs\u2019 Planetarium WordPress Plugin\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.ameeba.com\/blog\/"},{"label":"Uncategorized","link":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/"},{"label":"CVE-2023-6532: Cross-Site Request Forgery Vulnerability in WP Blogs&#8217; Planetarium WordPress Plugin","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/"}],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/19220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=19220"}],"version-history":[{"count":0,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/19220\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=19220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=19220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=19220"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=19220"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=19220"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=19220"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=19220"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=19220"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=19220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}