CVE-2021-24749 URL Shortify < 1.5.1 - Arbitrary Link/Group Deletion via CSRF

2021-11-2908:25:32

CWE-352

WPScan

www.cve.org

wordpress plugin

csrf attack

arbitrary link/group deletion

AI Score

Confidence

High

EPSS

0.001

Percentile

27.6%

JSON

The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.

CNA Affected

[
  {
    "product": "URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.5.1",
        "status": "affected",
        "version": "1.5.1",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/4b4e417d-0ae2-4c3c-81e6-4dcf39eb5697