CaPa Protect <= 0.5.8.2 - Cross-Site Request Forgery to Settings Update
mediumThe CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable the applied protection.
- CVSS:
- 6.8
- Affected:
- up to 0.5.8.2
- Fix:
- No patched version reported
- Disclosed:
- May 30, 2022