miniOrange’s Google Authenticator by miniOrange

miniOrange’s Google Authenticator by miniOrange <= 5.5.82 - CSRF

LANACOMMONVDB ID: d1232cad-c088-486b-8530-377814d60d31

The plugin does not have proper Cross-Site Request Forgery (CSRF) check in some places, which could allow attackers to make logged in admins perform unwanted actions via Cross-Site Request Forgery (CSRF) attacks.

References

Source Code: https://wordpress.org/plugins/miniorange-2-factor-authentication/

CVE: CVE-2022-42461

Attributes

Catgory: WordPress Plugin

Discovered: 2022-08-26

Published: 2022-10-31

Affected Version: <= 5.5.82

Classification

Type: Cross-Site Request Forgery (CSRF)

Researcher

Name: István Márton

Email: [email protected]