Lucene search

K
wpvulndbBob MatyasWPVDB-ID:D42F74DD-520F-40AA-9CF0-3544DB9562C7
HistoryApr 11, 2024 - 12:00 a.m.

Modal Window < 5.3.10 - Modal Deletion via CSRF

2024-04-1100:00:00
Bob Matyas
wpscan.com
5
modal window
csrf attack
bulk deletion
security vulnerability
admin privilege escalation

AI Score

6.3

Confidence

High

EPSS

0

Percentile

9.0%

Description The plugin does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack

PoC

Have a logged in admin open an HTML file containing where ID is an existing modal: action

AI Score

6.3

Confidence

High

EPSS

0

Percentile

9.0%

Related for WPVDB-ID:D42F74DD-520F-40AA-9CF0-3544DB9562C7