WP Customer Area < 8.1.4 - Unauthorised Actions via CSRF

CVE-2022-4745

Summary

The WP Customer Area plugin for WordPress prior to version 8.1.4 is vulnerable to Cross-Site Request Forgery (CSRF) due to insufficient checks during specific actions such as creating directories, changing file permissions, and copying files. This lack of protection can be exploited by an attacker to trick an authenticated administrator into performing unintended actions, potentially resulting in unauthorized file manipulation and the creation of arbitrary folders within the affected WordPress installation.

References