WordPress Plugin Vulnerabilities

PHP Everywhere < 2.0.3 - Arbitrary Settings Update via CSRF

Description

The plugin does not have CSRF check when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
php-everywhere
Fixed in 2.0.3

References

CVE
CVE-2021-23227
URL
https://plugins.trac.wordpress.org/changeset/2648829

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Rasif Afeef
Verified
Yes
WPVDB ID
77006954-3b7c-4157-8ea4-867b59883558

Timeline

Publicly Published
2022-01-13 (about 4 years ago)
Added
2022-01-14 (about 4 years ago)
Last Updated
2022-04-12 (about 4 years ago)

Other

Published
Title
Published
2024-08-27
Title
infolinks Ad Wrap <= 1.0.2 - Settings Update via CSRF
Published
2014-08-01
Title
WP Maintenance Mode 1.8.7 - Setting Manipulation CSRF
Published
2025-11-10
Title
CTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation
Published
2025-12-11
Title
Resource Library for Logged In Users < 1.6 - Cross-Site Request Forgery to Multiple Administrative Actions
Published
2023-10-26
Title
WP Knowledgebase <= 1.3.4 - CSRF