Software License Manager < 4.5.1 - Arbitrary Domain Deletion via CSRF

The del_reistered_domains AJAX action of the plugin does not have any CSRF checks, and is vulnerable to a CSRF attack

Proof of Concept

https://example.com/wp-admin/admin-ajax.php?action=del_reistered_domain&id=1

Fixed in version 4.5.1✓

CVE

URL

Type

CSRF

OWASP top 10

CWE

Original Researcher

Harald Eilertsen (JetPack)

Submitter

Harald Eilertsen

Verified

Yes

WPVDB ID

Publicly Published

2021-09-13 (about 1 months ago)

Added

2021-09-13 (about 1 months ago)

Last Updated

2021-09-14 (about 1 months ago)