CVE-2022-0499

The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones...

CVE-2022-0499 Sermon Browser <= 0.45.22 - Arbitrary File Upload via CSRF

The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones...

CVE-2022-0499

Summary: CVE-2022-0499 affects the WordPress plugin Sermon Browser, versions ≤ 0.45.22. The issue, as described in multiple sources, is that the plugin lacks CSRF protection and does not validate uploaded Sermon files, allowing a logged-in admin to upload arbitrary files such as PHP scripts. Deta...