The Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.20. This is due to missing or incorrect nonce validation on the seedprod_lite_redirect_to_site() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
This vulnerability affects the following application versions:
- Website Builder by SeedProd 6.13.0
- Website Builder by SeedProd 6.13.1
- Website Builder by SeedProd 6.15.3
- Website Builder by SeedProd 6.15.4
- Website Builder by SeedProd 6.15.6
- Website Builder by SeedProd 6.15.7
- Website Builder by SeedProd 6.15.13.1
- Website Builder by SeedProd 6.15.15.3
- Website Builder by SeedProd 6.15.19
- Website Builder by SeedProd 6.15.20