Front End Users, 3d137d82d6524fe37c8dd356efe27e9e4e9af54c

CVE, Research URL: 3d137d82d6524fe37c8dd356efe27e9e4e9af54c
Home page URL: Security reports for Front End Users
Application: Front End Users
Published on: Apr 07, 2023
Research Description: Front End Users [front-end-only-users] < 3.2.25 Front End Users <= 3.2.24 - Cross-Site Request Forgery The Front End Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.24. This is due to missing or incorrect nonce validation on several functions such as Mass_Delete_EWD_FEUP_Users, Delete_All_EWD_FEUP_Users, and Mass_Delete_EWD_FEUP_Fields. This makes it possible for unauthenticated attackers to potentially delete users, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: Min -, max 3.2.25.
Status: vulnerable