WordPress Simple Folio प्लगइन <= 1.1.0 - क्रॉस साइट रिक्वेस्ट फोर्जरी (CSRF) भेद्यता

The CSRF vulnerability in Simple Folio allows attackers to craft malicious requests that appear to originate from a legitimate user. If successful, an attacker could modify plugin settings, create or delete portfolios, or perform other actions as the logged-in user. The impact is particularly concerning for administrators, as their actions could be hijacked to compromise the entire WordPress site. While the CVSS score is medium, the ease of exploitation and potential for widespread impact across WordPress installations warrants attention.

WordPress websites using the Simple Folio plugin, particularly those running older versions (0–1.1.0), are at risk. Shared hosting environments where plugin updates are not consistently managed are also particularly vulnerable, as they may not be promptly updated to the patched version.

• wordpress / composer / npm:

grep -r 'simple-folio/simple-folio' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list | grep simple-folio

• wordpress / composer / npm:

wp plugin update simple-folio

1. 2025-12-09Disclosure

   disclosure

1. आरक्षित2025-10-29
2. प्रकाशित2025-12-09
3. संशोधित2026-04-28
4. EPSS अद्यतन2026-03-23

The primary mitigation is to upgrade the Simple Folio plugin to version 1.1.1 or later, which contains the fix. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) rule to filter out suspicious requests targeting the vulnerable endpoints. Specifically, look for requests with unexpected origins or referers. Additionally, educate users about the risks of clicking on untrusted links and entering sensitive information on unfamiliar websites. After upgrading, verify the fix by attempting to submit a crafted CSRF request and confirming it is blocked.

सक्रिय इंस्टॉलेशन

30

प्लगइन रेटिंग