Block Update < 3.3.2 - Arbitrary Plugin Update Blocking via CSRF

2023-10-1000:00:00

wpscan.com

plugin

csrf

security

update

attackers

logged in admins

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.3%

JSON

Description The plugin does not have CSRF check when blocking plugin from being updated, which could allow attackers to make logged in admins perform such actions via a CSRF attack

CPENameOperatorVersion
eq3.3.2

CPE	Name	Operator	Version
		eq	3.3.2

References

patchstack.com/database/vulnerability/block-specific-plugin-updates/wordpress-block-plugin-update-plugin-3-3-cross-site-request-forgery-csrf-vulnerability