6.5
Medium
CVE-2024-7864 The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the…
Description
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Favicon Generator (CLOSED) 2.1 | earliest → < 2.1 | 2.1 |
| favicon_generator 2.1 | earliest → < 2.1 | 2.1 |