WordPress Plugin Vulnerabilities
WP Private Content Plus < 3.2 - Cross-Site Request Forgery
Description
The plugin does not protect its save_groups function against CSRF attacks, allowing an unauthenticated attacker to add new group members on their behalf by tricking a logged in administrator to submit a crafted request.
Affects Plugins
Fixed in 3.2 References
Classification
Type
CSRF
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Jerome Bruandet
Verified
No
WPVDB ID
Timeline
Publicly Published
2021-03-01 (about 5 years ago)
Added
2023-07-03 (about 2 years ago)
Last Updated
2024-03-12 (about 1 year ago)
WPScan 