Tag Archives: nonce

CSRF Attack on WordPress

by Austin Matzko on February 13, 2008 at 11:47 am

Someone named Ferruh has a proof-of-concept cross-site request forgery (CSRF) attack against WordPress (HT: DK at BlogSecurity). I’ve tried it out successfully on my own version of WordPress 2.3.3. The scenario is like this: you go to leave a comment on someone’s site, and surreptitiously that (evil) site tricks you into changing your WordPress admin [...]

Posted in Security | Also tagged , | Read the 12 comments