CVE-2022-1779
Assigner: WPScan
Published: 2022-06-13T12:42:49
State: PUBLISHED
affected: product: Auto Delete Posts
vendor: Unknown
versions: lessThanOrEqual: 1.3.0
status: affected
version: 1.3.0
versionType: custom
credits: value: Daniel Ruf
descriptions: value: The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once.
problemTypes: descriptions: cweId: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
source: discovery: EXTERNAL
title: Auto Delete Posts <= 1.3.0 - Arbitrary Settings Update via CSRF
x_generator: WPScan CVE Generator