Shoppable Images Lite < 1.2.4 - Arbitrary Post Deletion via CSRF

2023-02-1300:00:00

wpscan.com

shoppable images lite

arbitrary post deletion

csrf

security vulnerability

image deletion

logged-in admins

0.001 Low

EPSS

Percentile

27.5%

JSON

The plugin does not have CSRF checks in some places, for example when deleting/updating images. Furthermore, it does not ensure that the image to be deleted are actually images, which could allow attackers to make logged in admins delete arbitrary posts via a CSRF attack

CPENameOperatorVersion
mabel-shoppable-images-litelt1.2.4

CPE	Name	Operator	Version
	mabel-shoppable-images-lite	lt	1.2.4

0.001 Low

EPSS

Percentile

27.5%

JSON

Related for WPVDB-ID:F4C2366D-473A-461E-A6BD-E05463594223