CSRF vulnerability
-
Description: Any registered user can delete all WordPress database tables and files. A browser request makes it possible: http://wp.dev/wp-admin/admin-ajax.php?action=uninstall
The plugin does not check for user rights
Viewing 1 replies (of 1 total)
Viewing 1 replies (of 1 total)
The topic ‘CSRF vulnerability’ is closed to new replies.