The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts/pages from the blog
References
Link | Resource |
---|---|
https://plugins.trac.wordpress.org/changeset?new=2749780%40wp-edit-menu%2Ftrunk&old=2220186%40wp-edit-menu%2Ftrunk | Patch Third Party Advisory |
https://wpscan.com/vulnerability/92de9c1b-48dd-4a5f-bbb3-455f8f172b09 | Exploit Patch Third Party Advisory |
Configurations
History
No history.
Information
Published : 2022-08-22 15:15
Updated : 2024-02-28 19:29
NVD link : CVE-2022-2276
Mitre link : CVE-2022-2276
CVE.ORG link : CVE-2022-2276
JSON object : View
Products Affected
wp_edit_menu_project
- wp_edit_menu