Lucene search
WPScanCVELIST:CVE-2021-25116HistoryJun 13, 2022 - 12:41 p.m.
CVE-2021-25116 Enqueue Anything <= 1.0.1 - Subscriber+ Arbitrary Asset/Post Deletion
2022-06-1312:41:23
WPScan
www.cve.org
0.001 Low
EPSS
Percentile
21.2%
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Enqueue Anything",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThanOrEqual": "1.0.1"
}
],
"defaultStatus": "affected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
wpexploit
wpexploit
Enqueue Anything <= 1.0.1 - Subscriber+ Arbitrary Asset/Post Deletion
2022-05-17 00:00:00
cnvd
cnvd
WordPress Enqueue Anything plugin跨站请求伪造漏洞
2022-06-15 00:00:00
patchstack
patchstack
nvd
nvd
CVE-2021-25116
2022-06-13 13:15:09
wpvulndb
wpvulndb
Enqueue Anything <= 1.0.1 - Subscriber+ Arbitrary Asset/Post Deletion
2022-05-17 00:00:00
cve
cve
CVE-2021-25116
2022-06-13 13:15:09
prion
prion
Cross site request forgery (csrf)
2022-06-13 13:15:00