Publish Confirm Message < 2.0 - Settings Update via CSRF

2023-10-1300:00:00

wpscan.com

plugin

csrf check

settings update

admin

attack

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.3%

JSON

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CPENameOperatorVersion
eq2.0

CPE	Name	Operator	Version
		eq	2.0

References

patchstack.com/database/vulnerability/publish-confirm-message/wordpress-publish-confirm-message-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability