CVE-2022-1793CWE-352

Private Files <= 0.40 - Protection Disabling via CSRF

published June 13, 2022

CVSS
—
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00429 · 36.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-06-13T12:43Z
EPSS history
Timeline
  • 13 JUN 12:43Z
    Private Files <= 0.40 - Protection Disabling via CSRF
    cvelistv5