WordPress Plugin Vulnerabilities

AutomatorWP < 2.5.1 - Object Deletion via CSRF

Description

The plugin does not have CSRF check when deleting objects managed by the plugins, which could allow attackers to make logged in admins perform such action via a CSRF attack

Affects Plugins

Plugin icon
automatorwp
Fixed in 2.5.1

References

CVE
CVE-2023-23992

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Rafshanzani Suhada
Verified
No
WPVDB ID
630886ac-ac1d-4f72-b435-3cb6617c9a33

Timeline

Publicly Published
2023-01-20 (about 3 years ago)
Added
2023-02-28 (about 3 years ago)
Last Updated
2023-02-28 (about 3 years ago)

Other

Published
Title
Published
2023-02-27
Title
Read More Excerpt Link <= 1.6 - Settings Update via CSRF
Published
2023-05-29
Title
WOLF < 1.0.7.1 - Profile Creation via CSRF
Published
2026-02-13
Title
WP Quick Contact Us <= 1.0 - Cross-Site Request Forgery to Settings Update
Published
2024-03-19
Title
Woomotiv < 3.5.0 - Review Count Reset via CSRF
Published
2022-05-26
Title
Mail Subscribe List < 2.1.4 - Arbitrary Subscribed User Deletion via CSRF