CVE-2023-1088
Assigner: WPScan
Published: 2023-03-27T15:37:18.954Z
State: PUBLISHED
title: WP Plugin Manager < 1.1.8 - Arbitrary Plugin Activation via CSRF
problemTypes: descriptions: description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
affected: vendor: Unknown
product: WP Plugin Manager
versions: status: affected
versionType: custom
version: 0
lessThan: 1.1.8
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
descriptions: value: The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
credits: value: WPScan
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator