CVE-2023-0498
Assigner: WPScan
Published: 2023-03-27T15:37:18.168Z
State: PUBLISHED
title: WP Education < 1.2.7 - Arbitrary Plugin Activation via CSRF
problemTypes: descriptions: description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
affected: vendor: Unknown
product: WP Education
versions: status: affected
versionType: custom
version: 0
lessThan: 1.2.7
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
descriptions: value: The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
credits: value: Lana Codes
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator