Plugin Vulnerability Allert! | WordPress.org

Boxerke
(@boxerke)

12 years ago

dear devs,

Please check this: https://vexatioustendencies.com/wordpress-plugin-vulnerability-dump-part-2/

Thanks

https://wordpress.org/plugins/w3-total-cache/

Viewing 1 replies (of 1 total)

Julio Potier
(@juliobox)

12 years ago

This is a CSRF vulnerability, a nonce token is missing on these links:
http://www.example.com/wp-admin/admin.php?page=w3tc_dashboard&w3tc_edge_mode_enable
and
http://www.example.com/wp-admin/admin.php?page=w3tc_dashboard&w3tc_edge_mode_disnable

Use wp_nonce_url(), thank you

Viewing 1 replies (of 1 total)

The topic ‘Plugin Vulnerability Allert!’ is closed to new replies.

1 reply
2 participants
Last reply from: Julio Potier
Last activity: 12 years ago
Status: not resolved