CVE-2022-3899

3DPrint < 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF

High · published January 16, 2024

CVSS v3.1
8.1
EPSS
0%
Percentile
33.5
In the wild
Unconfirmed
What it is

The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged in admin into submitting a form.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00404 · 33.5th percentile
Published
2024-01-16T15:50Z
EPSS history
Timeline
  • 16 JAN 15:50Z
    3DPrint < 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF
    cvelistv5