WordPress Plugin Vulnerabilities

Kudos Donations < 3.1.2 - Arbitrary Items Deletion via CSRF

Description

The plugin has a logic flaw in its CSRF checks when deleting items such as Donors, Transactions, Subscriptions etc, allowing attackers to make a logged in admin delete them

Proof of Concept

Affects Plugins

Plugin icon
kudos-donations
Fixed in 3.1.2

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
7.1 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
6372d8e3-60c2-41d9-84f1-7092e2c66f04

Timeline

Publicly Published
2021-11-22 (about 4 years ago)
Added
2021-11-22 (about 4 years ago)
Last Updated
2021-11-22 (about 4 years ago)

Other

Published
Title
Published
2024-04-05
Title
MM-email2image <= 0.2.5 - Stored XSS via CSRF
Published
2024-07-20
Title
GamiPress - Reset User <= 1.0.0 - GamiPress User Data Removal via CSRF
Published
2023-11-07
Title
Auto Affiliate Links < 6.4.2.5 - Settings Update to Stored XSS via CSRF
Published
2025-02-03
Title
Style Tweaker <= 0.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-01-16
Title
Free MailClient FMC <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting