WordPress Plugin Vulnerabilities

MaxButtons < 9.3 - Arbitrary Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
maxbuttons
Fixed in 9.3

References

CVE
CVE-2022-36346

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Muhammad Daffa
Verified
No
WPVDB ID
c1b448e0-430a-4f47-aded-77af8d291232

Timeline

Publicly Published
2022-08-02 (about 3 years ago)
Added
2022-08-22 (about 3 years ago)
Last Updated
2023-05-13 (about 3 years ago)

Other

Published
Title
Published
2024-07-09
Title
Pardakht Delkhah < 2.9.9 - Form Fields Reset via CSRF
Published
2024-12-12
Title
WP Fiddle <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-01-08
Title
Woocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
Published
2021-07-02
Title
Woostify < 1.9.2 - CSRF Bypass
Published
2022-06-27
Title
Jquery Validation For Contact Form 7 < 5.3 - Arbitrary Options Update via CSRF