WordPress Plugin Vulnerabilities
Tiempo.com <= 0.1.2 - Shortcode Deletion via CSRF
Description
The plugin does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete arbitrary shortcode via a CSRF attack
Proof of Concept
Make a logged in admin open the URL below, this will make them delete the shortcode with ID 1 https://example.com/wp-admin/admin.php?page=tiempocom/app/admin.php&action=delete&shortcode=1
Affects Plugins
No known fix References
CVE
Classification
Type
CSRF
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-04-25 (about 7 months ago)
Added
2023-04-25 (about 7 months ago)
Last Updated
2023-04-25 (about 7 months ago)
WPScan 