Description
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Favicon Generator (CLOSED) | < 2.1 | 2.1 |
References
- https://wpscan.com/vulnerability/6ce62e78-04a4-46b2-b97f-c4ef8f3258c3/ exploit vdb-entry technical-description