WordPress Plugin Vulnerabilities

Login/Signup Popup < 2.4 - Settings Reset via CSRF

Description

The plugin does not have CSRF check when reseting its settings, which could allow attackers to make logged in admins perform such action via a CSRF attack

Proof of Concept

Affects Plugins

Plugin icon
easy-login-woocommerce
Fixed in 2.4

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Verified
Yes
WPVDB ID
100e6d23-fcf9-4ea9-bd8f-f941d38480cf

Timeline

Publicly Published
2023-07-03 (about 2 years ago)
Added
2023-07-03 (about 2 years ago)
Last Updated
2023-07-03 (about 2 years ago)

Other

Published
Title
Published
2023-03-14
Title
CF7 Invisible reCAPTCHA < 1.3.4 - CSRF
Published
2024-08-22
Title
Misiek Photo Album <= 1.4.3 - Album Deletion via CSRF
Published
2023-06-26
Title
Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite < 1.0.0 - CSRF to Stored XSS
Published
2025-04-22
Title
affiliate-toolkit < 3.7.4 - Cross-Site Request Forgery
Published
2023-04-19
Title
Gallery Metabox <= 1.5 - Gallery Removal via CSRF