WP Logs Book <= 1.0.1 - Log Clearing via CSRF

2024-05-3100:00:00

Bob Matyas

wpscan.com

plugin

csrf attack

logs

security vulnerability

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not have CSRF check when clearing logs, which could allow attackers to make a logged in admin clear the logs them via a CSRF attack

PoC

Make an admin open an HTML file containing: Note: The 404 Error Logs can also be cleared by modifying the PoC