CVE-2026-93870 - Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler
Brief
CVE ID : CVE-2026-93870
Published : Sept. 18, 2026, 8:17 p. m.
- 38 minutes ago
Description : Cotonti through 1.
- 0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users.
Severity: 5.3
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...