Description
The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP-Reply Notify | ≤ 1.1 | — |
References
- https://wpscan.com/vulnerability/72279ca0-6365-4c83-adca-4d8e5808a8c5/ exploit vdb-entry technical-description