WordPress Private Messages For WordPress plugin <= 2.1.10 - Sending Messages via Cross-Site Request Forgery (CSRF) vulnerability

2022-05-2600:00:00

BEE-K (Patchstack)

patchstack.com

0.001 Low

EPSS

Percentile

20.8%

JSON

Sending Messages via Cross-Site Request Forgery (CSRF) vulnerability discovered by BEE-K (Patchstack) in WordPress Private Messages For WordPress plugin (versions <= 2.1.10).

Solution

Deactivate and delete. This plugin has been closed as of May 20, 2022 and is not available for download. This closure is temporary, pending a full review.

CPENameOperatorVersion
private messages for wordpressle2.1.10

CPE	Name	Operator	Version
	private messages for wordpress	le	2.1.10

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29441

wordpress.org/plugins/private-messages-for-wordpress/

0.001 Low

EPSS

Percentile

20.8%

JSON

Related for PATCHSTACK:258A6D202341FDB71A20392C3B959E30