WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager, CVE-2023-1624
- CVE, Research URL
- Home page URL
- Application
-
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager
- Published on
- Apr 25, 2023
- Research Description
- The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders
- Affected versions
-
max 2.0.9.
- Status
-
vulnerable