WPCode Lite < 2.0.9 - Arbitrary Log File Deletion via CSRF

2023-04-0300:00:00

wpvulndb

wpcode lite

arbitrary deletion

csrf

logged in user

url exploit

0.001 Low

EPSS

Percentile

25.2%

JSON

The plugin has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders

Make a logged in user with the wpcode_activate_snippets  capability open the URL below

https://example.com/wp-admin/admin.php?page=wpcode-tools&view=logs&wpcode_action=delete_log&log=../../delete-me.log

This will make them delete the ~/wp-content/delete-me.log

0.001 Low

EPSS

Percentile

25.2%

JSON

Related for WPEX-ID:132B70E5-4368-43B4-81F6-2D01BC09DC8F