CVE-2023-5884: BACK2NATURE Word Balloon

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.

Affected products

• BACK2NATURE Word Balloon: before 4.20.3 (fixed in 4.20.3)

Published 2023-12-04. Last modified 2026-06-17.