CVE-2019-11886

The WaspThemes Visual CSS Style Editor aka yellow-pencil-visual-theme-customizer plugin before 7.2.1 for WordPress allows ypoptionupdate CSRF, as demonstrated by use of ypremoteget to obtain admin access...

CVE-2019-11886

The WaspThemes Visual CSS Style Editor aka yellow-pencil-visual-theme-customizer plugin before 7.2.1 for WordPress allows ypoptionupdate CSRF, as demonstrated by use of ypremoteget to obtain admin access...

CVE-2019-11886

The CVE-2019-11886 entry concerns the WordPress plugin Yellow Pencil Visual Theme Customizer (WaspThemes Visual CSS Style Editor) versions prior to 7.2.1. The vulnerability arises from yp_option_update CSRF, demonstrated via yp_remote_get, enabling an unauthenticated attacker to obtain administra...