WP Shamsi by wpvar – Lana Codes

WP Shamsi by wpvar <= 4.3.3 - Subscriber+ Attachment Deletion

LANACOMMONVDB ID: ea3b5bb4-d69a-4346-be3c-bd93cdb06ee8

The plugin has Cross-Site Request Forgery (CSRF) and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment.

You must be log in to view vulnerability details.

Or register a new account.

References

Source Code: https://wordpress.org/plugins/wp-shamsi/

CVE: CVE-2023-0335

Attributes

Catgory: WordPress Plugin

Discovered: 2023-01-10

Published: 2023-02-28

Affected Version: <= 4.3.3

Classification

Type: Cross-Site Request Forgery (CSRF), Missing Authorization

Researcher

Name: István Márton

Email: [email protected]

Support Us?

We would truly appreciate it if you bought us a bunny (food for a snow leopard).