Description
The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Shamsi | ≤ 4.3.3 | — |
References
- https://wpscan.com/vulnerability/f7a20bea-c3d5-431b-bdcf-e189c81a561a exploit vdb-entry technical-description