Lucene search

K
prionPRIOn knowledge basePRION:CVE-2023-0725
HistoryFeb 08, 2023 - 2:15 a.m.

Cross site request forgery (csrf)

2023-02-0802:15:00
PRIOn knowledge base
www.prio-n.com
3
wordpress
wicked folders plugin
cross-site request forgery
nonce validation
ajax function
unauthenticated attackers
site administrator

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

36.5%

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_clone_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

36.5%

Related for PRION:CVE-2023-0725