Osiris Signature Banner is a WordPress plugin that allows site administrators to manage signature banner settings. In all versions up to and including 0.5, the plugin is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on a function that processes requests. This flaw can let an unauthenticated attacker cause a victim administrator (via a browser action like clicking a link) to unknowingly submit a forged request that updates plugin settings and injects malicious web scripts.
Technically, the issue is a CSRF weakness (CWE-352) stemming from nonce validation being missing or incorrect. Because the nonce check is not properly enforced, the plugin accepts forged requests that should have been rejected without a valid, request-specific token. The attack vector is network-based: an attacker crafts a malicious request and delivers it to the administrator through a UI interaction (e.g., a link click). If the administrator is tricked into performing the action while authenticated to WordPress, the forged request can be processed, resulting in unauthorized settings changes and the ability to inject malicious scripts into the site.
Impact: A successful attack can allow an attacker to modify the Osiris Signature Banner configuration and inject malicious web scripts, which can lead to client-side compromise (e.g., script execution in visitors’ browsers) and potential downstream impacts such as phishing, defacement, or session/token theft depending on what the injected scripts do. The CVSS score is 6.1 (medium) with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network reachability, low attack complexity, no required privileges for the attacker, but user interaction is required (UI:R). The scope is changed (S:C), suggesting the impact can extend beyond the vulnerable component.
Mitigation: Upgrade the Osiris Signature Banner plugin to a version newer than 0.5, where correct nonce validation should be implemented for the affected settings/update function. As a workaround, reduce the likelihood of administrators being tricked into clicking attacker-controlled links (e.g., educate admins, use browser protections, and avoid following unsolicited links), since exploitation requires user interaction. Detection guidance (limited by available data): monitor for unexpected changes to Osiris Signature Banner settings and for any newly added or modified script content associated with the plugin, especially after external link interactions by administrators.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-352