CVE-2022-3489

The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the customwpadminslug settings, allowing unauthenticated attackers to update it with a crafted request...

Cross site request forgery (csrf)

The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the customwpadminslug settings, allowing unauthenticated attackers to update it with a crafted request...

CVE-2022-3489

WP Hide WordPress plugin (versions 0.0.0–0.0.2) is affected by an unauthenticated settings update vulnerability in the custom_wpadmin_slug feature. The root cause is missing authorization and CSRF checks on the update endpoint (Settings update for the slug), enabling unauthenticated attackers to ...