HL Twitter <= 2014.1.18 - Unlink Twitter Account via CSRF

2024-04-2400:00:00

Bob Matyas

wpscan.com

csrf

vulnerability

unlinking accounts

security

software

AI Score

6.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Description The plugin does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack

PoC

Make an admin open an HTML file containing: The Twitter connection will be removed (API tokens reset to '')