Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CSRF Vulnerability via Patchstack #13

Closed
georgeolaru opened this issue Mar 2, 2023 · 0 comments
Closed

CSRF Vulnerability via Patchstack #13

georgeolaru opened this issue Mar 2, 2023 · 0 comments
Assignees
@pixelgradebot
Labels
security
Milestone
0.7.1

Comments

@georgeolaru
Copy link
Member

georgeolaru commented Mar 2, 2023 •
edited
Loading

There seems to be an issue where the plugin does not have CSRF check in place when updating/resetting its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Reference
WPScan
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@pixelgradebot pixelgradebot

Labels
security
Projects
None yet
Milestone
0.7.1
Development

No branches or pull requests
2 participants
@georgeolaru @pixelgradebot