Multiple Plugins from Inisev - Plugin Installation via CSRF

2023-07-2800:00:00

wpscan.com

inisev

csrf attack

plugin installation

security vulnerability

software

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

Description Multiple plugins from the Inisev vendor are lacking CSRF check in the handle_installation function hooked to the inisev_installation AJAX action, allowing unauthenticated attackers to make logged in admins install plugins from Inisev on the blog via a CSRF attack

CPENameOperatorVersion
feedburner-alternative-and-rss-redirecteq3.8
feedburner-alternative-and-rss-redirecteq2.8.2
feedburner-alternative-and-rss-redirecteq1.4.0
feedburner-alternative-and-rss-redirecteq2.3.8
feedburner-alternative-and-rss-redirecteq1.5.8
feedburner-alternative-and-rss-redirecteq1.2.8
feedburner-alternative-and-rss-redirecteq1.1.4
feedburner-alternative-and-rss-redirecteq2.2.5
feedburner-alternative-and-rss-redirecteq3.2.4
feedburner-alternative-and-rss-redirecteq1.2.0

Name	Operator	Version
feedburner-alternative-and-rss-redirect	eq	3.8
feedburner-alternative-and-rss-redirect	eq	2.8.2
feedburner-alternative-and-rss-redirect	eq	1.4.0
feedburner-alternative-and-rss-redirect	eq	2.3.8
feedburner-alternative-and-rss-redirect	eq	1.5.8
feedburner-alternative-and-rss-redirect	eq	1.2.8
feedburner-alternative-and-rss-redirect	eq	1.1.4
feedburner-alternative-and-rss-redirect	eq	2.2.5
feedburner-alternative-and-rss-redirect	eq	3.2.4
feedburner-alternative-and-rss-redirect	eq	1.2.0

Rows per page:

1-10 of 111