WordPress Plugin Vulnerabilities

Download < 1.1.0 - Cross-Site Request Forgery

Description

The plugin does not properly validate and verify user requests use nonces, making it susceptible to Cross-Site Request Forgery (CSRF) attacks.

Affects Plugins

Plugin icon
download-theme
Fixed in 1.1.0

References

CVE
CVE-2022-38062
URL
https://patchstack.com/database/vulnerability/download-theme/wordpress-download-theme-plugin-1-0-9-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
61576d1e-0f49-4ef5-837b-1e4cf8a10133

Timeline

Publicly Published
2023-05-24 (about 2 years ago)
Added
2023-07-18 (about 2 years ago)
Last Updated
2023-07-18 (about 2 years ago)

Other

Published
Title
Published
2023-12-07
Title
BC Menu Bar Cart Icon For WooCommerce By Binary Carpenter <= 1.49.3 - Cross-Site Request Forgery
Published
2023-11-12
Title
ShiftController Employee Shift Scheduling < 4.9.24 - CSRF
Published
2025-04-09
Title
Mergado Pack <= 4.2.1 - Stored XSS via CSRF
Published
2023-01-27
Title
Quick Restaurant Menu < 2.1.0 - Menu Items Update via CSRF
Published
2025-02-11
Title
Houzez Property Feed < 2.4.22 - Cross-Site Request Forgery to Property Feed Export Deletion