WordPress Plugin Vulnerabilities

WP ERP < 1.6.4 - Cross-Site Request Forgery

Description

The plugin does not protect its handle_leave_calendar_filter, add_enable_disable_option_save, leave_policies, process_bulk_action, and process_crm_contact functions AJAX actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request.

Affects Plugins

Plugin icon
erp
Fixed in 1.6.4

References

CVE
CVE-2020-36735
URL
https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Jerome Bruandet
Verified
No
WPVDB ID
fbc8b9f1-7ccd-4753-96a8-3244e84524c5

Timeline

Publicly Published
2020-09-26 (about 5 years ago)
Added
2023-07-03 (about 2 years ago)
Last Updated
2023-07-03 (about 2 years ago)

Other

Published
Title
Published
2019-12-22
Title
Rencontre <= 3.2.2 - Multiple CSRF
Published
2024-08-17
Title
WP MultiTasking <= 0.1.12 - Welcome Popup Update via CSRF
Published
2016-08-15
Title
Email Users <= 4.8.3 - Cross-Site Request Forgery (CSRF)
Published
2023-04-14
Title
Custom Order Numbers for WooCommerce < 1.4.1 - CSRF
Published
2025-07-22
Title
Omnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint