Description
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.
Remediation
References
Related Vulnerabilities
WordPress Plugin Upload File Type Settings Cross-Site Scripting (1.1)
WordPress Plugin Product Addons & Fields for WooCommerce Cross-Site Scripting (18.3)
Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2022-42130)
Oracle Database Server CVE-2004-2345 Vulnerability (CVE-2004-2345)
WordPress Plugin Podlove Podcast Publisher Multiple Vulnerabilities (2.3.15)