6.5
Medium
CVE-2023-1624 The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be…
Description
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPCode 2.0 | earliest → < 2.0.9 | 2.0.9 |
Other CVEs of WPCode
The 4 CVEs of WPCode →
CVE-2026-101301
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen…
5.3
Medium
CVE-2023-3524
The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading…
6.1
Medium
CVE-2023-0328
The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only…
Not rated