Absolute Privacy <= 2.1 - User Email/Password Change via Cross-Site Request Forgery

2023-08-1000:00:00

wpscan.com

absolute privacy

user email

password change

cross-site request forgery

csrf

csrf attack

unauthenticated attacker

logged in administrator

AI Score

6.7

Confidence

High

EPSS

0.002

Percentile

57.4%

JSON

Description The plugin does not protect its abpr_profileShortcode action against CSRF attacks, allowing an unauthenticated attacker to change a users email or password by tricking a logged in administrator to submit a crafted request.

References

www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/absolute-privacy/absolute-privacy-21-cross-site-request-forgery-to-user-emailpassword-change