WordPress Plugin Vulnerabilities
Woody Ad Snippets < 2.2.6 - Arbitrary Post Deletion
Description
The adminInit() function of the admin/includes/class.actions.snippets.php file, registered as an admin_init hook did not have any CSRF or capability checks for its close action, allowing unauthenticated users to delete arbitrary posts from the blog
Proof of Concept
Affects Plugins
Fixed in 2.2.6 References
CVE
Classification
Type
ACCESS CONTROLS
OWASP top 10
CWE
CVSS
Miscellaneous
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2019-08-09 (about 6 years ago)
Added
2021-03-03 (about 5 years ago)
Last Updated
2021-03-05 (about 5 years ago)
WPScan 