Lucene search
Bob MatyasWPVDB-ID:DC44D85F-AFE8-4824-95B0-11B9ABFB04D8HistoryApr 25, 2024 - 12:00 a.m.
Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF
2024-04-2500:00:00
Bob Matyas
wpscan.com
5
csrf vulnerability
subscriber deletion
attack
newsletter popup
Description The plugin does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack
PoC
Make an admin open a link where `` is a valid user: http://example.com/wp-admin/admin.php?page=wp_newsletter_show_localrecord&action;=delete&rid;=
Related
cve
cve
CVE-2024-3642
2024-05-16 06:15:09
nvd
nvd
CVE-2024-3642
2024-05-16 06:15:09
cvelist
cvelist
CVE-2024-3642 Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF
2024-05-16 06:00:02
vulnrichment
vulnrichment
CVE-2024-3642 Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF
2024-05-16 06:00:02
wpexploit
wpexploit
Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF
2024-04-25 00:00:00
AI Score
6.4
Confidence
High
EPSS
0
Percentile
9.0%
Related for WPVDB-ID:DC44D85F-AFE8-4824-95B0-11B9ABFB04D8