CVE-2021-25097 LabTools <= 1.0 - Subscriber+ Arbitrary Publication Deletion

2022-02-0100:00:00

CWE-863

CWE-352

WPScan

www.cve.org

0.0005 Low

EPSS

Percentile

16.2%

JSON

The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "LabTools",
    "versions": [
      {
        "version": "1.0",
        "status": "affected",
        "lessThanOrEqual": "1.0",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/67f5beb8-2cb0-4b43-87c7-dead9c005f9c

0.0005 Low

EPSS

Percentile

16.2%

JSON

Related for CVELIST:CVE-2021-25097