WordPress Plugin Vulnerabilities

CSRF Bypass in Multiple Plugins

Description

Multiple plugins are affected by CSRF bypass as they do not properly check for the nonce due to a logic flaw. This could allow attackers to make logged in users do unwanted actions

Affects Plugins

Plugin icon
qtranslate-slug
No known fix
Plugin icon
dc-woocommerce-multi-vendor
Fixed in 3.7.4
Plugin icon
custom-css-js-php
No known fix
Plugin icon
multiple-roles
Fixed in 1.3.2
Plugin icon
absolute-reviews
Fixed in 1.0.9
Plugin icon
advanced-popups
Fixed in 1.1.2
Plugin icon
remove-schema
Fixed in 1.6
Plugin icon
sunshine-photo-cart
Fixed in 2.8.29
Plugin icon
woo-gift-cards-lite
Fixed in 2.1.2
Plugin icon
wp-mpdf
Fixed in 3.5.2
Plugin icon
staff-directory-pro
Fixed in 4.0
Plugin icon
dw-question-answer
No known fix
Plugin icon
contact-form-7-style
No known fix

References

CVE
CVE-2021-4416
CVE
CVE-2021-4415
CVE
CVE-2021-4408
CVE
CVE-2021-4421
CVE
CVE-2021-4426
URL
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/
URL
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Jerome Bruandet (NinTechNet)
Verified
Yes
WPVDB ID
3725296b-c316-440a-875a-3068fb876b3b

Timeline

Publicly Published
2021-06-08 (about 4 years ago)
Added
2021-06-08 (about 4 years ago)
Last Updated
2023-07-12 (about 2 years ago)

Other

Published
Title
Published
2025-03-24
Title
Pro Rank Tracker <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2014-12-14
Title
DandyID Services <= 1.5.9 - Multiple CSRF
Published
2023-10-16
Title
Post Gallery <= 2.3.12 - Arbitrary Settings Update via CSRF
Published
2023-10-03
Title
WP Power Stats <= 2.2.3 - CSRF
Published
2025-05-19
Title
reCAPTCHA for all < 2.27 - Cross-Site Request Forgery