David Kierznowski has reported a vulnerability in the AdSense-Deluxe plugin for WordPress, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The vulnerability is caused due to adsense-deluxe.php allowing administrators to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to change certain settings by enticing a logged-in administrator to visit a malicious site.

Solution
Do not visit untrusted sites while being logged on to WordPress.

Provided and/or discovered by
David Kierznowski

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://michaeldaw.org/alerts/alerts-200507/

Deep Links
Links available to Secunia VIM customers