CVE-2026-93870

Name of the Vulnerable Software and Affected Versions Cotonti versions prior to 1.0.1

Description The ratings plugin AJAX handler fails to validate anti-CSRF tokens, which are unique tokens used to prevent Cross-Site Request Forgery (CSRF)—an attack that forces an authenticated user to execute unwanted actions. This allows attackers to forge ratings on behalf of authenticated users by crafting malicious pages that automatically submit POST requests to modify stored rating data when visited by logged-in users.

Recommendations Update to a version newer than 1.0.0.