WordPress Plugin Vulnerabilities

Maintenance Switch <= 1.7.1 - Theme Files Creation/Deletion via CSRF

Description

The plugin does not have CSRF checks when creating and deleting theme files as well as reseting settings, which could allow attackers to make logged in admins perform such actions via CSRF attacks

Affects Plugins

Plugin icon
maintenance-switch
No known fix

References

CVE
CVE-2023-29235
URL
https://patchstack.com/database/wordpress/plugin/maintenance-switch/vulnerability/wordpress-maintenance-switch-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Elliot
Verified
No
WPVDB ID
4b60e118-361d-45d1-afa7-abcc5416095b

Timeline

Publicly Published
2023-08-28 (about 2 years ago)
Added
2023-10-12 (about 2 years ago)
Last Updated
2025-12-27 (about 4 months ago)

Other

Published
Title
Published
2024-08-16
Title
WebinarPress < 1.33.21 - Cross-Site Request Forgery
Published
2023-10-26
Title
Thumbnail Slider With Lightbox < 1.0.1 - Arbitrary File Upload via CSRF
Published
2026-03-20
Title
Post Snippits <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
Published
2023-08-11
Title
WooCommerce Product Attachment < 2.2.0 - Checkout Attachements Update via CSRF
Published
2025-01-16
Title
Password Protect Plugin for WordPress <= 0.8.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting