Themes Vulnerabilities
Ask Me < 6.8.7 - Post Deletion via CSRF
Description
The plugin has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.
Proof of Concept
An attacker can log in to their own account, grab the link structure of the post-deletion request, and then forge it to the victim's post ID and send it to the victim. As soon as the victim accesses the link, the post will be deleted without asking for confirmation or using a nonce.
Affects Themes
Fixed in version 6.8.7
References
Classification
Miscellaneous
Original Researcher
Srijan Adhikari
Submitter
Srijan Adhikari
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-10-28 (about 7 months ago)
Added
2022-10-28 (about 7 months ago)
Last Updated
2022-10-31 (about 6 months ago)