6.5
Moyenne
CVE-2023-1624 The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be…
Description
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WPCode 2.0 | premières → < 2.0.9 | 2.0.9 |
Autres CVE de WPCode
Les 4 CVE de WPCode →
CVE-2026-101301
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen…
5.3
Moyenne
CVE-2023-3524
The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading…
6.1
Moyenne
CVE-2023-0328
The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only…
Non notée