CVE-2021-24668 MAZ Loader < 1.4.1 - Arbitrary Loader Deletion via CSRF

2021-11-2319:16:05

CWE-352

WPScan

www.cve.org

maz loader

wordpress plugin

csrf

arbitrary deletion

AI Score

Confidence

High

EPSS

0.001

Percentile

27.6%

JSON

The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack

CNA Affected

[
  {
    "product": "MAZ Loader – Preloader Builder for WordPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.4.1",
        "status": "affected",
        "version": "1.4.1",
        "versionType": "custom"
      }
    ]
  }
]