CVE-2023-2079

HIGH

Buy Me a Coffee - Button and Widget Plugin <= 3.7 - Cross-Site Request Forgery via Missing Nonce Validation

Title source: llm
STIX 2.1

Description

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for unauthenticated attackers to update the plugins settings, via a forged request granted the attacker can trick a site's administrator into performing an action such as clicking on a link.

References (4)

Core 4

Scores

CVSS v3 7.1
EPSS 0.0029
EPSS Percentile 20.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (2)
buymeacoffee/Buy Me a Coffee – Button and Widget Plugin < 3.7
buymeacoffee/buy_me_a_coffee < 3.8
Published Jul 11, 2023
Tracked Since Feb 18, 2026