OOPSpam Anti-Spam, b957cef578d741a99449d3ac6672dac1ad1596b4

CVE, Research URL: b957cef578d741a99449d3ac6672dac1ad1596b4
Home page URL: Security reports for OOPSpam Anti-Spam
Application: OOPSpam Anti-Spam
Published on: Jun 21, 2023
Research Description: OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) [oopspam-anti-spam] < 1.1.45 OOPSpam Anti-Spam <= 1.1.44 - Cross-Site Request Forgery via empty_ham_entries and empty_spam_entries The OOPSpam Anti-Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.44. This is due to missing or incorrect nonce validation on the 'empty_ham_entries' and 'empty_spam_entries' functions. This makes it possible for unauthenticated attackers to delete both spam and legitimate entries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 1.1.45.
Status: vulnerable