Wow Skype Buttons < 4.0.4 - Button Deletion via CSRF

2024-04-1100:00:00

Bob Matyas

wpscan.com

skype buttons

csrf vulnerability

unauthorized deletion

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks

PoC

As an admin open HTML file containing: action

CPENameOperatorVersion
eq4.0.4

CPE	Name	Operator	Version
		eq	4.0.4