CVE-2023-6532

The WP Blogs' Planetarium WordPress plugin through 1.0 performs no CSRF check when its settings are updated. That lets an attacker forge a settings-change request: if a logged-in administrator is lured to a malicious page while authenticated to WordPress, their browser silently submits the change under the admin's identity. The impact is confined to the plugin's own settings, delivered through the victim rather than a direct server hit.

The tempering realities are two. First, exploitation requires the social-engineering step of getting an admin to trigger the request, which is why this rides on user interaction rather than being fire-and-forget. Second, the scope is the plugin's settings, not arbitrary site control — so while a forged configuration change is a genuine integrity issue, it's narrower than the plugin bugs in this batch that yield code execution.

WordPress plugins are notoriously hard to inventory — installed per-site, often on sites no one tracks centrally — so our first move is simply finding where this one runs, given its tiny footprint. We hold it at a modest priority behind the unauthenticated and file-upload plugin flaws, lean on referrer-based detection of forged state changes around wp-admin, and note that its limited settings-only impact keeps it off the urgent list.