Lucene search

Daniel RufWPVDB-ID:A0CA68D3-F885-46C9-9F6B-B77AD387D25D

HistoryJan 03, 2024 - 12:00 a.m.

WordPress Users <= 1.4 - Settings Update via CSRF

2024-01-0300:00:00

Daniel Ruf

wpscan.com

wordpress

csrf

settings update

admin

attack

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

24.1%

JSON

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

PoC

Create an HTML with the following and open it when logged in as an Editor or above:

References

magos-securitas.com/txt/2023-6390.txt