Lucene search
Bob MatyasWPVDB-ID:BF540242-5306-4C94-AD50-782D0D5B127FHistoryApr 11, 2024 - 12:00 a.m.
Sticky Buttons < 3.2.4 - Button Deletion via CSRF
2024-04-1100:00:00
Bob Matyas
wpscan.com
3
sticky buttons
csrf
security vulnerability
admin actions
button deletion
poc
software update
Description The plugin does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
PoC
Make a logged in admin open an HTML file where ID is a valid ID: action
| CPE | Name | Operator | Version |
|---|---|---|---|
| eq | 3.2.4 |
Related
cvelist
cvelist
CVE-2024-3475 Sticky Buttons < 3.2.4 - Button Deletion via CSRF
2024-05-02 06:00:02
nvd
nvd
CVE-2024-3475
2024-05-02 06:15:50
wpexploit
wpexploit
Sticky Buttons < 3.2.4 - Button Deletion via CSRF
2024-04-11 00:00:00
cve
cve
CVE-2024-3475
2024-05-02 06:15:50
wordfence
wordfence
6.3 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%
Related for WPVDB-ID:BF540242-5306-4C94-AD50-782D0D5B127F