Easy Pricing Tables < 3.1.3 - Arbitrary Post Removal via CSRF
CVE-2021-25098

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
Pricing Tables WordPress Plugin – Easy Pricing Tables
Vendor
CVE Published:
7 March 2022

Summary

The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in admin remove arbitrary posts from the blog via a CSRF attack, which will be put in the trash

Affected Version(s)

Pricing Tables WordPress Plugin – Easy Pricing Tables 3.1.3

References

https://wpscan.com/vulnerability/960a634d-a88a-4d90-9ac3-...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.