WordPress LWS Cleaner plugin <= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file' vulnerability

Authenticated Administrator+ Arbitrary File Deletion via 'lwscldeletefile' vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin LWS Cleaner versions = 2.4.1.3...

WordPress LWS Cleaner Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software LWS Cleaner Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-35781 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID eac11e5294d8 Credits konagash Required...