StopBadBots by Bill Minozzi

StopBadBots by Bill Minozzi <= 7.23 - Subscriber+ Arbitrary Plugin Installation

LANACOMMONVDB ID: 185ff811-61e7-4e2d-8177-edde1876cd87

The plugin does not have proper authorisation and Cross-Site Request Forgery (CSRF) check in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org repository.

You must be log in to view vulnerability details.

Or register a new account.

References

Source Code: https://wordpress.org/plugins/stopbadbots/

CVE: CVE-2022-3883

Attributes

Catgory: WordPress Plugin

Discovered: 2022-11-07

Published: 2022-11-21

Affected Version: <= 7.23

Classification

Type: Cross-Site Request Forgery (CSRF), Missing Authorization

Researcher

Name: István Márton

Email: [email protected]

Support Us?

We would truly appreciate it if you bought us a bunny (food for a snow leopard).