Reuters Direct <= 3.0.0 - Cross-Site Request Forgery permettant la réinitialisation des paramètres

The primary impact of this CSRF vulnerability is the potential for unauthorized modification of the Reuters Direct plugin's settings. An attacker could leverage this to alter configurations, potentially impacting the plugin's functionality or introducing malicious behavior. While the plugin itself may not directly expose sensitive data, changes to its settings could indirectly affect the broader WordPress site's security posture. The attack requires the administrator to click a malicious link, making social engineering a key component of exploitation. This vulnerability is similar to other CSRF flaws where an attacker can perform actions on behalf of an authenticated user without their knowledge.

WordPress sites utilizing the Reuters Direct plugin, particularly those with site administrators who are susceptible to social engineering attacks, are at risk. Shared hosting environments where multiple WordPress sites share the same server resources could also be affected, as a compromise on one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'class-reuters-direct-settings.php' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list | grep reuters-direct

• wordpress / composer / npm:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=reuters_direct_settings_save&nonce=malicious_nonce | head -n 1

1. 2025-11-27Disclosure

   disclosure

1. Réservé2025-10-31
2. Publiée2025-11-27
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The recommended mitigation is to immediately upgrade the Reuters Direct plugin to a version that addresses this vulnerability. The vendor has not yet released a fixed version, so temporary workarounds include restricting access to the 'class-reuters-direct-settings.php' page using WordPress access control plugins. Implement a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Regularly review WordPress user permissions to ensure only authorized personnel have access to plugin settings.