Herd Effects < 5.2.4 - Effect Deletion via CSRF

2023-08-2100:00:00

Erwan LR (WPScan)

csrf

admin

deletion

4.7 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Description The plugin does not have CSRF when deleting its items, which could allow attackers to make logged in admins delete arbitrary effects via a CSRF attack

Make a logged in admin open https://example.com/wp-admin/admin.php?page=mwp-herd-effect&info=delete&did=1, this will make them delete the effect with ID 1