DoFollow Case by Case < 3.5.0 - Email&URLs Adding to Allowlist via CSRF

2023-12-1200:00:00

wpscan.com

dofollow

case by case

csrf

urls

allowlist

security

vulnerability

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

24.1%

JSON

Description The plugin does not have CSRF checks in its getEmail and getUrl functions, which could allow attackers to make logged in admins add email and URLs to the allow list via CSRF attacks

References

patchstack.com/database/vulnerability/dofollow-case-by-case/wordpress-dofollow-case-by-case-plugin-3-4-2-cross-site-request-forgery-csrf-vulnerability