Plugin WordPress Giveaways and Contests by RafflePress <= 1.12.20 - Vulnérabilité Cross Site Request Forgery (CSRF)

This CSRF vulnerability allows an attacker to trick a logged-in user into unknowingly performing actions they did not intend. For example, an attacker could craft a malicious link that, when clicked by an administrator, could modify contest settings, delete entries, or even compromise user data associated with the RafflePress plugin. The potential impact is significant, as it could lead to data manipulation, unauthorized contest modifications, and ultimately, a loss of trust in the platform. Successful exploitation requires the user to be authenticated and interact with the malicious link, typically through a phishing campaign or by embedding the malicious code on a website the user visits.

Websites utilizing the Giveaways and Contests by RafflePress plugin, particularly those with administrator accounts that are frequently targeted by phishing campaigns, are at risk. Shared hosting environments where plugin updates are managed centrally are also vulnerable if they haven't applied the update.

• wordpress / composer / npm:

grep -r 'rafflepress_entry_create' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list --status=all | grep RafflePress

• wordpress / composer / npm:

wp plugin update RafflePress

• generic web: Check for unusual contest modifications or unexpected user actions within the RafflePress plugin. Monitor WordPress error logs for CSRF-related errors.

1. 2025-11-21Disclosure

   disclosure

1. Réservé2025-11-21
2. Publiée2025-11-21
3. Modifiée2026-04-28
4. EPSS mis à jour2026-03-23

The primary mitigation is to upgrade the Giveaways and Contests by RafflePress plugin to version 1.12.21 or later. If immediate upgrade is not possible due to compatibility issues or testing requirements, consider implementing stricter input validation and output encoding within the plugin's code to reduce the attack surface. While a Web Application Firewall (WAF) might offer some protection, it's unlikely to be effective against CSRF attacks without specific rules tailored to RafflePress. Implement a CSRF token validation mechanism within RafflePress itself as a long-term solution. After upgrading, confirm the fix by attempting to trigger a contest action via a crafted URL; the action should be rejected if the CSRF protection is functioning correctly.

Installations actives

30KNiche

Note du plugin