WP Coder < 2.5.3 - Code Deletion via CSRF

2022-07-2600:00:00

Krzysztof Zając

wpscan.com

wordpress

coder

plugin

code deletion

csrf

attackers

admin

0.001 Low

EPSS

Percentile

26.3%

JSON

The plugin does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack

PoC

https://example.com/wp-admin/admin.php?page=wp-coder&info;=del&did;=1

CPENameOperatorVersion
wp-coderlt2.5.3

CPE	Name	Operator	Version
	wp-coder	lt	2.5.3

0.001 Low

EPSS

Percentile

26.3%

JSON

Related for WPVDB-ID:50ACD35F-EB31-4ABA-BF32-B390E9514BEB