CVE-2023-7196

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Ultimate Noindex Nofollow Tool	<= 1.1.2

References

https://wpscan.com/vulnerability/15ea1ffd-5a0c-422c-8c9c-7b632516a156/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/15ea1ffd-5a0c-422c-8c9c-7b632516a156/Exploit, Third Party Advisory

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-71977.1The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as esca CVE-2023-71984.3The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authe CVE-2023-71995.3The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read dra CVE-2023-72006.1The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle CVE-2023-72016.5The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such CVE-2023-72026.1The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any CVE-2023-72036.1The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as l CVE-2023-72047.5The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides CVE-2023-72067.8In Horner Automation Cscape versions 9.90 SP10 and prior, local attackers are able to exploit this vulnerability if a user opens a malicious CVE-2023-72074.9Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regre CVE-2023-72089.8A vulnerability classified as critical was found in Totolink X2000R_V2 2.0.0-B20230727.10434. This vulnerability affects the function formTm CVE-2023-72097.5A vulnerability was found in Uniway Router up to 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of