CVE-2023-5975

The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to update the plugin settings via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/imagemapper/tags/1.2.6/imagemapper.php#L904Patch
• https://plugins.trac.wordpress.org/browser/imagemapper/tags/1.2.6/imagemapper.php#L916Patch
• https://plugins.trac.wordpress.org/browser/imagemapper/tags/1.2.6/imagemapper.php#L939Patch
• https://plugins.trac.wordpress.org/browser/imagemapper/tags/1.2.6/imagemapper.php#L958Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a128018b-f19b-4b18-a53c-cf1310d3d0e7?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/imagemapper/tags/1.2.6/imagemapper.php#L904Patch
• https://plugins.trac.wordpress.org/browser/imagemapper/tags/1.2.6/imagemapper.php#L916Patch
• https://plugins.trac.wordpress.org/browser/imagemapper/tags/1.2.6/imagemapper.php#L939Patch
• https://plugins.trac.wordpress.org/browser/imagemapper/tags/1.2.6/imagemapper.php#L958Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a128018b-f19b-4b18-a53c-cf1310d3d0e7?source=cveThird Party Advisory

Published

Nov 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-5969Mattermost fails to properly sanitize the request to /api/v4…5.3
• CVE-2023-5970Improper authentication in the SMA100 SSL-VPN virtual office…8.8
• CVE-2023-5971The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3…4.8
• CVE-2023-5972A null pointer dereference flaw was found in the nft_inner.c…7.8
• CVE-2023-5973Brocade Web Interface in Brocade Fabric OS v9.x and before …4.3
• CVE-2023-5974The WPB Show Core WordPress plugin through 2.2 is vulnerable…9.8
• CVE-2023-5976Improper Access Control in GitHub repository microweber/micr…4.3
• CVE-2023-5977Rejected reason: Accidental Request.
• CVE-2023-5978In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, unde…7.5
• CVE-2023-5979The eCommerce Product Catalog Plugin for WordPress plugin be…6.5
• CVE-2023-5980The BSK Forms Blacklist WordPress plugin before 3.7 does not…4.8
• CVE-2023-5981A vulnerability was found that the response times to malform…5.9