WordPress Plugin Vulnerabilities

Name Directory <= 1.27.1 - Settings Update via CSRF

Description

The plugin does not have CSRF check when updating its settings, which could allow attackers to make logged in admins perform such action via a CSRF attack

Affects Plugins

Plugin icon
name-directory
Fixed in 1.27.2

References

CVE
CVE-2023-22692

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
NeginNrb
Verified
No
WPVDB ID
ba305ed0-15b8-4191-a710-b3eea9817357

Timeline

Publicly Published
2023-01-23 (about 3 years ago)
Added
2023-05-23 (about 2 years ago)
Last Updated
2023-05-23 (about 2 years ago)

Other

Published
Title
Published
2025-09-22
Title
LWS Affiliation <= 2.3.6 - Cross-Site Request Forgery
Published
2021-10-06
Title
Genie WP Favicon <= 0.5.2 - Arbitrary Favicon Change via CSRF
Published
2022-09-14
Title
Advanced Dynamic Pricing for WooCommerce < 4.1.4 - Settings Update via CSRF
Published
2026-03-10
Title
LatePoint – Calendar Booking Plugin for Appointments and Events < 5.2.8 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
Published
2024-07-24
Title
Ninja Forms < 3.8.7 - Cross-Site Request Forgery