Lucene search
Daniel RufWPVDB-ID:F4FCF41B-C05D-4236-8E67-A52D0F94C80AHistorySep 05, 2022 - 12:00 a.m.
Login Block IPs <= 1.0.0 - Arbitrary Setting Update via CSRF
2022-09-0500:00:00
Daniel Ruf
wpscan.com
13
csrf attack
admin
security settings
EPSS
0.001
Percentile
25.9%
The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PoC
Make a logged in admin open a page containing the HTML code below
Related
cvelist
cvelist
CVE-2022-3098 Login Block IPs <= 1.0.0 - Arbitrary Setting Update via CSRF
2022-09-26 12:35:43
patchstack
patchstack
cve
cve
CVE-2022-3098
2022-09-26 13:15:11
nvd
nvd
CVE-2022-3098
2022-09-26 13:15:11
prion
prion
Cross site request forgery (csrf)
2022-09-26 13:15:00
cnvd
cnvd
WordPress Login Block IPs cross-site request forgery vulnerability
2022-09-28 00:00:00
wpexploit
wpexploit
Login Block IPs <= 1.0.0 - Arbitrary Setting Update via CSRF
2022-09-05 00:00:00