Ask Me < 6.8.7 – Post Deletion via CSRF | CVE 2022-3750 | Theme Vulnerabilities

Description

The plugin has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.

Proof of Concept

An attacker can log in to their own account, grab the link structure of the post-deletion request, and then forge it to the victim's post ID and send it to the victim. As soon as the victim accesses the link, the post will be deleted without asking for confirmation or using a nonce.

Affects Themes

Fixed in 6.8.7

References

CVE

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Srijan Adhikari

Submitter

Srijan Adhikari

Submitter twitter

Verified

Yes

WPVDB ID

5019db80-0356-497d-b488-a26a5de78676

Timeline

Publicly Published

2022-10-28 (about 3 years ago)

Added

2022-10-28 (about 3 years ago)

Last Updated

2022-10-31 (about 3 years ago)

Other

Published

Title

Published

2025-01-16

Title

Anonymize Links <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2025-02-03

Title

Facilita Form Tracker <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2024-01-03

Title

WP Social Bookmark Menu <= 1.2 - Settings Update via CSRF

Published

2025-06-05

Title

Free WP Mail SMTP <= 1.0 - Cross-Site Request Forgery

Published

2024-02-09

Title

WP Contact Form <= 1.6 - Cross-Site Request Forgery via wpcf_adminpage