WP Coder < 2.5.3 - Code Deletion via CSRF

2022-07-2600:00:00

Krzysztof Zając

193

wordpress

coder

plugin

csrf

code deletion

vulnerability

exploit

0.001 Low

EPSS

Percentile

26.3%

JSON

The plugin does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack

https://example.com/wp-admin/admin.php?page=wp-coder&info=del&did=1

0.001 Low

EPSS

Percentile

26.3%

JSON

Related for WPEX-ID:50ACD35F-EB31-4ABA-BF32-B390E9514BEB