Lucene search
Daniel RufWPVDB-ID:C0257564-48EE-4D02-865F-82C8B5E793C9HistoryMay 13, 2022 - 12:00 a.m.
Files Download Delay < 1.0.7 - Subscriber+ Settings Reset
2022-05-1300:00:00
Daniel Ruf
wpscan.com
8
0.001 Low
EPSS
Percentile
21.2%
The plugin does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.
PoC
https://example.com/wp-admin/admin-ajax.php?action=ddlay_restore_defaults
| CPE | Name | Operator | Version |
|---|---|---|---|
| files-download-delay | lt | 1.0.7 |
Related
patchstack
patchstack
nvd
nvd
CVE-2022-1570
2022-06-08 10:15:09
wpexploit
wpexploit
Files Download Delay < 1.0.7 - Subscriber+ Settings Reset
2022-05-13 00:00:00
cve
cve
CVE-2022-1570
2022-06-08 10:15:09
cvelist
cvelist
CVE-2022-1570 Files Download Delay < 1.0.7 - Subscriber+ Settings Reset
2022-06-06 08:51:07
prion
prion
Cross site request forgery (csrf)
2022-06-08 10:15:00
cnvd
cnvd
WordPress Files Download Delay plugin跨站请求伪造漏洞
2022-06-13 00:00:00