Lucene search
Erwan LR (WPScan)WPVDB-ID:93B40030-3706-4063-BF59-4EC983AFDBB6HistoryAug 21, 2023 - 12:00 a.m.
Herd Effects < 5.2.4 - Effect Deletion via CSRF
2023-08-2100:00:00
Erwan LR (WPScan)
wpscan.com
11
csrf attack
logged in admins
arbitrary effects
Description The plugin does not have CSRF when deleting its items, which could allow attackers to make logged in admins delete arbitrary effects via a CSRF attack
PoC
Make a logged in admin open https://example.com/wp-admin/admin.php?page=mwp-herd-effect&info;=delete&did;=1, this will make them delete the effect with ID 1
Related
prion
prion
Cross site request forgery (csrf)
2023-09-11 20:15:00
cve
cve
CVE-2023-4318
2023-09-11 20:15:12
cvelist
cvelist
CVE-2023-4318 Herd Effects < 5.2.4 - Effect Deletion via CSRF
2023-09-11 19:46:05
wpexploit
wpexploit
Herd Effects < 5.2.4 - Effect Deletion via CSRF
2023-08-21 00:00:00
nvd
nvd
CVE-2023-4318
2023-09-11 20:15:12
wordfence
wordfence
AI Score
4.6
Confidence
High
EPSS
0.001
Percentile
30.3%
Related for WPVDB-ID:93B40030-3706-4063-BF59-4EC983AFDBB6