CVE-2023-2079 in Buy Me a Coffee Plugin
Summary
by MITRE • 07/11/2023
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for unauthenticated attackers to update the plugins settings, via a forged request granted the attacker can trick a site's administrator into performing an action such as clicking on a link.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/10/2026
The CVE-2023-2079 vulnerability affects the "Buy Me a Coffee – Button and Widget Plugin" for WordPress, representing a critical cross-site request forgery flaw that undermines the security integrity of affected websites. This vulnerability exists within the plugin's core functionality where specific functions lack proper nonce validation mechanisms, creating an exploitable attack vector that allows unauthenticated adversaries to manipulate plugin settings without legitimate authorization. The vulnerability impacts all versions up to and including 3.7, making it a widespread concern for WordPress administrators who have not updated their installations.
The technical flaw manifests in four specific functions: receive_post, bmc_disconnect, name_post, and widget_post, which fail to validate nonce tokens before processing user requests. This absence of nonce verification creates a condition where attackers can craft malicious requests that appear legitimate to the WordPress system, enabling them to execute unauthorized operations. According to CWE-352, this vulnerability directly maps to Cross-Site Request Forgery, a well-documented security weakness that occurs when a web application fails to verify the origin of requests. The flaw essentially allows attackers to perform actions on behalf of authenticated users without their knowledge or consent, which aligns with the ATT&CK technique T1566.002 for Phishing with Malicious Attachments and T1566.003 for Spearphishing Attachment, as the attack typically requires social engineering to trick administrators into executing malicious requests.
The operational impact of this vulnerability extends beyond simple configuration changes, as attackers can potentially gain persistent access to plugin settings that control payment processing, widget configurations, and user interaction parameters. When an administrator inadvertently clicks on a malicious link or visits a compromised website, the forged request can execute with the administrator's privileges, allowing attackers to modify critical plugin parameters that may affect payment processing, user data handling, and overall site functionality. The vulnerability's exploitation requires minimal technical skill and relies heavily on social engineering tactics, making it particularly dangerous for administrators who may not be aware of the risks. This weakness creates a persistent threat vector that can be leveraged for data manipulation, service disruption, and potentially more severe attacks depending on the plugin's integration with other site components. The attack surface is further expanded because the plugin's functions are designed to handle sensitive operations that could enable attackers to modify payment configurations, alter widget displays, or disconnect user accounts, all without proper authentication mechanisms.
Mitigation strategies must focus on immediate plugin updates to versions that implement proper nonce validation, as well as implementing additional security measures such as web application firewalls and monitoring for suspicious requests. Administrators should also conduct thorough security audits of their WordPress installations to identify any other plugins with similar vulnerabilities. The implementation of proper nonce validation addresses the root cause by ensuring that all requests to sensitive functions contain valid tokens that can be verified against the user's session, thereby preventing unauthorized modifications. Organizations should also consider implementing security awareness training for administrators to reduce the risk of successful social engineering attacks that exploit this vulnerability, as the attack chain typically requires user interaction to be effective. Regular security assessments and vulnerability scanning should be conducted to identify and remediate similar weaknesses across the entire WordPress ecosystem, ensuring comprehensive protection against CSRF attacks and related threats.