BMLT WordPress Plugin <= 3.11.4 - Cross-Site Request Forgery zur Erstellung und Löschung von Einstellungen

The primary impact of this CSRF vulnerability is the ability for an attacker to modify the BMLT WordPress Satellite plugin's configuration without authentication. By crafting malicious links or forms, an attacker can induce a site administrator to unknowingly execute actions that create or delete plugin options. This could lead to unauthorized changes in plugin behavior, potentially impacting site functionality or exposing sensitive data. While the direct data at risk is limited to plugin-specific settings, the ability to alter plugin behavior could have broader consequences depending on the plugin's functionality and integration with other site components. This vulnerability shares similarities with other CSRF exploits where user interaction is required to trigger the malicious action.

WordPress websites utilizing the BMLT WordPress Satellite plugin, particularly those with administrator accounts that are not adequately protected with strong passwords and multi-factor authentication, are at risk. Shared hosting environments where multiple websites share the same server resources are also potentially vulnerable, as a compromise of one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'BMLTPlugin_create_option' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list | grep BMLT

• wordpress / composer / npm:

wp plugin update --all

• generic web: Check for suspicious URLs containing plugin-specific parameters in access logs. • generic web: Inspect HTTP requests for unexpected POST requests targeting plugin endpoints.

1. 2025-12-11Disclosure

   disclosure

Aktive Installationen

100

Plugin-Bewertung

5.0

Erfordert WordPress

6.2+

Kompatibel bis

6.9.4

Erfordert PHP

8.1+

1. Reserviert2025-12-05
2. Veröffentlicht2025-12-11
3. Geändert2026-04-15
4. EPSS aktualisiert2026-03-23

The recommended mitigation is to immediately upgrade the BMLT WordPress Satellite plugin to a version newer than 3.11.4, where the vulnerability has been addressed. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, ensure that all administrator accounts have strong, unique passwords and that multi-factor authentication is enabled. Regularly review plugin settings for any unauthorized modifications. There are no specific Sigma or YARA rules readily available for this particular vulnerability, but generic CSRF detection rules can be applied.