Disable User Login < 1.3.9 - User Login Toggle via CSRF

2023-12-2300:00:00

wpscan.com

plugin

csrf

vulnerability

unauthorized

user login

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

24.1%

JSON

Description The plugin does not have CSRF check in its bulk action, which could allow attackers to make logged in admins enable and disable login for arbitrary users via a CSRF attack

References

patchstack.com/database/vulnerability/disable-user-login/wordpress-disable-user-login-plugin-1-3-7-cross-site-request-forgery-csrf-vulnerability