WordPress Plugin Vulnerabilities

Competition Form <= 2.0 - Competition Deletion via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Proof of Concept

Affects Plugins

Plugin icon
competition-form
No known fix

References

CVE
CVE-2024-12750

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Bob Matyas
Submitter
Bob Matyas
Submitter website
https://www.bobmatyas.com
Submitter twitter
bobmatyas
Verified
Yes
WPVDB ID
f3570bdc-659f-4a03-96f8-b4f9f045f910

Timeline

Publicly Published
2024-12-14 (about 1 year ago)
Added
2025-01-07 (about 11 months ago)
Last Updated
2025-01-07 (about 11 months ago)

Other

Published
Title
Published
2023-07-11
Title
MyCurator Content Curation < 3.75 - Cross-Site Request Forgery
Published
2023-02-23
Title
For the visually impaired <= 0.58 - Cross-Site Request Forgery (CSRF)
Published
2023-09-29
Title
WP Captcha <= 2.0.0 - Settings Update via CSRF
Published
2023-11-17
Title
Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site Scripting
Published
2025-01-06
Title
AI WP Writer < 3.8.4.5 - Cross-Site Request Forgery