Norby AI <= 1.0.3 - 跨站请求伪造可更新设置

The primary impact of this CSRF vulnerability is the ability for an attacker to modify the Norby AI plugin's configuration without authentication. By crafting a malicious request and tricking a site administrator into clicking a link or visiting a compromised page, an attacker can alter plugin settings. This could involve injecting arbitrary JavaScript code, potentially leading to account takeover, data theft, or defacement of the WordPress site. The blast radius extends to any site utilizing the vulnerable Norby AI plugin, particularly those with administrative access that could be socially engineered into executing the malicious request.

WordPress sites utilizing the Norby AI plugin, particularly those with shared hosting environments where multiple users may have access to the same WordPress installation. Sites with less stringent security practices or those that do not regularly update their plugins are also at increased risk.

• wordpress / composer / npm:

grep -r 'settings_update' /var/www/html/wp-content/plugins/norby-ai/

• wordpress / composer / npm:

wp plugin list --status=all | grep norby-ai

• generic web: Check for unusual plugin settings changes in the WordPress admin panel. • generic web: Review WordPress access logs for suspicious requests targeting the plugin's settings endpoint.

1. 2025-12-05Disclosure

   disclosure

1. 已保留2025-11-18
2. 发布日期2025-12-05
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

The recommended mitigation is to immediately upgrade the Norby AI plugin to a version that addresses this CSRF vulnerability. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting access to the plugin's settings page. This can be achieved through role-based access control (RBAC) plugins or custom code that limits access to authorized administrators only. While not a complete solution, this can reduce the attack surface. After upgrading, verify the fix by attempting to access the plugin's settings page from a different browser session without being logged in as an administrator; the page should redirect or display an access denied error.