The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/163091/WordPress-Database-Backups-1.2.2.6-Cross-Site-Request-Forgery.html | Exploit Third Party Advisory VDB Entry |
https://wpscan.com/vulnerability/350c3e9a-bcc2-486a-90e6-d1dc13ce1bd5 | Third Party Advisory |
http://packetstormsecurity.com/files/163091/WordPress-Database-Backups-1.2.2.6-Cross-Site-Request-Forgery.html | Exploit Third Party Advisory VDB Entry |
https://wpscan.com/vulnerability/350c3e9a-bcc2-486a-90e6-d1dc13ce1bd5 | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:52
Type | Values Removed | Values Added |
---|---|---|
References | () http://packetstormsecurity.com/files/163091/WordPress-Database-Backups-1.2.2.6-Cross-Site-Request-Forgery.html - Exploit, Third Party Advisory, VDB Entry | |
References | () https://wpscan.com/vulnerability/350c3e9a-bcc2-486a-90e6-d1dc13ce1bd5 - Third Party Advisory |
Information
Published : 2021-04-05 19:15
Updated : 2024-11-21 05:52
NVD link : CVE-2021-24174
Mitre link : CVE-2021-24174
CVE.ORG link : CVE-2021-24174
JSON object : View
Products Affected
database-backups_project
- database-backups
CWE
CWE-352
Cross-Site Request Forgery (CSRF)