Description
The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the possibility of deleting records (users) when an ID is known.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://twitter.com/UnD3sc0n0c1d0 ↗
- https://wordpress.org/plugins/multi-scheduler/#developers ↗
- https://infayer.com/archivos/448 ↗
- https://www.exploit-db.com/exploits/48532 ↗
- https://packetstormsecurity.com/files/157867/WordPress-Multi-Scheduler-1.0.0-Cross-Site-Request-Forgery.html ↗
- https://cxsecurity.com/issue/WLB-2020050235 ↗
- https://0day.today/exploit/34496 ↗
- https://research-labs.net/search/exploits/wordpress-plugin-multi-scheduler-100-cross-site-request-forgery-delete-user ↗