WordPress Plugin Vulnerabilities

Analytify < 4.2.3 - Cache Deletion via CSRF

Description

The plugin does not have CSRF check when deleting cache, which could allow attackers to make logged in admins perform such action via a CSRF attack

Affects Plugins

Plugin icon
wp-analytify
Fixed in 4.2.3

References

CVE
CVE-2022-38137

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Muhammad Daffa
Verified
No
WPVDB ID
a6dd973c-cdb8-4688-9401-f32f090731fb

Timeline

Publicly Published
2022-09-29 (about 3 years ago)
Added
2022-11-08 (about 3 years ago)
Last Updated
2022-11-08 (about 3 years ago)

Other

Published
Title
Published
2025-01-07
Title
Uptime Robot <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-05-16
Title
AlT Monitoring <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-07-05
Title
The Events Calendar < 6.5.1.5 - Cross-Site Request Forgery via action_restore_events
Published
2022-11-11
Title
Add Multiple Marker <= 1.3 - Settings Update via CSRF
Published
2014-08-01
Title
Calendar <= 1.3.2 - Entry Addition Cross-Site Request Forgery (CSRF)