Description
WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxes on the Write/Edit page via POST and GET requests to the options-general.php endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| henrikmelin | More Fields | 2.1 | — |
References
- ExploitDB-39507 exploit
- Product Reference product
- VulnCheck Advisory: WordPress More Fields Plugin 2.1 Cross-Site Request Forgery third-party-advisory