WordPress Plugin Vulnerabilities

Timthumb Scanner <= 1.54 - Scan Initialisation via CSRF

Description

The plugin does not have CSRF check when starting a scan, which could allow attackers to make logged in admins perform such action via a CSRF attack

Affects Plugins

Plugin icon
timthumb-vulnerability-scanner
No known fix

References

CVE
CVE-2023-44240

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
emad
Verified
No
WPVDB ID
c8d00fb6-626b-4620-abc5-de83047e882f

Timeline

Publicly Published
2023-09-29 (about 2 years ago)
Added
2023-10-09 (about 2 years ago)
Last Updated
2023-10-09 (about 2 years ago)

Other

Published
Title
Published
2022-09-01
Title
Captcha Code < 2.8 - Settings Update via CSRF
Published
2025-12-15
Title
Semrush Content Toolkit < 1.1.33 - Cross-Site Request Forgery
Published
2025-06-05
Title
Hive Support < 1.2.6 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function
Published
2016-08-04
Title
Events Made Easy < 1.6.21 - CSRF to Cross-Site Scripting (XSS)
Published
2024-07-10
Title
Metorik – Reports & Email Automation for WooCommerce < 1.7.2 - Cross-Site Request Forgery