Block Update < 3.3.2 - Arbitrary Plugin Update Blocking via CSRF

2023-10-1000:00:00

wpscan.com

plugin

csrf

security

update

attackers

logged in admins

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

24.1%

JSON

Description The plugin does not have CSRF check when blocking plugin from being updated, which could allow attackers to make logged in admins perform such actions via a CSRF attack

References

patchstack.com/database/vulnerability/block-specific-plugin-updates/wordpress-block-plugin-update-plugin-3-3-cross-site-request-forgery-csrf-vulnerability