The Core Tweaks WP Setup WordPress plugin through 4.1...
High severity
Unreviewed
Published
Mar 1, 2022
to the GitHub Advisory Database
•
Updated Feb 3, 2023
Description
Published by the National Vulnerability Database
Feb 28, 2022
Published to the GitHub Advisory Database
Mar 1, 2022
Last updated
Feb 3, 2023
The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks
References