CVE-2021-24749

State: PUBLISHED · Published: 2021-11-29 · Updated: 2024-08-03 · Assigner: WPScan

Description

The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.

CWE

CWE-352 — CWE-352 Cross-Site Request Forgery (CSRF)

Affected

Unknown / URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress — v=1.5.1 <1.5.1 [affected]

CVSS

(none)

References

https://wpscan.com/vulnerability/4b4e417d-0ae2-4c3c-81e6-4dcf39eb5697 x_refsource_MISC

Source

cvelistV5-main/cves/2021/24xxx/CVE-2021-24749.json