title: Word Balloon < 4.20.3 - Avatar Removal via CSRF
description: The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
vendor: Unknown
product: Word Balloon
versions:
status: affected, versionType: semver, version: 0, lessThan: 4.20.3
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}