WordPress Plugin Vulnerabilities

WP Basic Elements < 5.3.0 - Settings Update via CSRF

Description

The plugin does not protect its wpbe_save_settings ajax actions against CSRF attacks, allowing an unauthenticated attacker to update the plugin settings by tricking a logged in admin to submit a crafted request.

Affects Plugins

Plugin icon
wp-basic-elements
Fixed in 5.3.0

References

CVE
CVE-2022-47139

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
rezaduty
Verified
No
WPVDB ID
d7e36290-8959-4dcd-9dd1-09f23529e2d6

Timeline

Publicly Published
2023-03-14 (about 3 years ago)
Added
2023-05-29 (about 2 years ago)
Last Updated
2023-11-09 (about 2 years ago)

Other

Published
Title
Published
2025-07-21
Title
CBX Restaurant Booking <= 1.2.1 - Plugin Reset via CSRF
Published
2024-04-26
Title
WP GDPR Compliance <= 2.0.23 - Cross-Site Request Forgery
Published
2023-07-05
Title
Media Library Helper by Codexin < 1.3.0 - Cross-Site Request Forgery
Published
2023-10-13
Title
Mailrelay < 2.1.2 - Arbitrary Settings Update via CSRF
Published
2025-03-24
Title
Hacklog Remote Image Autosave <= 2.1.0 - Cross-Site Request Forgery