WP Clean Up <= 1.2.3 - Cross-Site Request Forgery (CSRF)

2023-03-0300:00:00

wpscan.com

wp clean up

csrf

cross-site request forgery

security

database

EPSS

0.001

Percentile

27.7%

JSON

The plugin does not protect its wp_clean_up_optimize action against CSRF attacks, allowing an unauthenticated attacker to perform various database clean-up operations by tricking a logged in user to submit a crafted request.

References

patchstack.com/database/vulnerability/wp-clean-up/wordpress-wp-clean-up-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability

EPSS

0.001

Percentile

27.7%

JSON

Related for WPVDB-ID:71C9D22E-D269-4473-A93F-706A3D6D8513