Cross site request forgery (csrf)

2019-09-1613:15:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

25.0%

JSON

The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.

CPENameOperatorVersion
estatiklt2.3.1

CPE	Name	Operator	Version
	estatik	lt	2.3.1

References

wordpress.org/plugins/estatik/

www.pluginvulnerabilities.com/2016/08/19/authenticated-arbitrary-file-upload-vulnerability-in-estatik/