Description
The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Subscribe2 | < 10.38 | 10.38 |
References
- https://wpscan.com/vulnerability/1965f53d-c94e-4322-9059-49de69df1051 exploit vdb-entry technical-description