Lucene search
PRIOn knowledge basePRION:CVE-2021-25116HistoryJun 13, 2022 - 1:15 p.m.
Cross site request forgery (csrf)
2022-06-1313:15:00
PRIOn knowledge base
www.prio-n.com
2
0.001 Low
EPSS
Percentile
21.2%
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
| CPE | Name | Operator | Version |
|---|---|---|---|
| enqueue_anything | le | 1.0.1 |
Related
wpexploit
wpexploit
Enqueue Anything <= 1.0.1 - Subscriber+ Arbitrary Asset/Post Deletion
2022-05-17 00:00:00
cnvd
cnvd
WordPress Enqueue Anything plugin跨站请求伪造漏洞
2022-06-15 00:00:00
patchstack
patchstack
nvd
nvd
CVE-2021-25116
2022-06-13 13:15:09
wpvulndb
wpvulndb
Enqueue Anything <= 1.0.1 - Subscriber+ Arbitrary Asset/Post Deletion
2022-05-17 00:00:00
cve
cve
CVE-2021-25116
2022-06-13 13:15:09
cvelist
cvelist