CVE-2022-1760 Core Control <= 1.2.1 - Arbitrary Settings Update via CSRF

The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1760

Core Control WordPress plugin up to version 1.2.1 is affected by a CSRF vulnerability that allows a logged-in admin to arbitrarily update settings. The root cause is missing CSRF checks during settings updates. Impact is limited to modification of settings by an attacker using a CSRF attack; no e...