CVE-2023-2842 WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF
Attackers can trick logged-in admins into deleting inventory items via CSRF, requiring an upgrade to the WP Inventory Manager plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-2842?
CVE-2023-2842 is a high-severity vulnerability in Unknown WP Inventory Manager, published on 27 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack
Which versions are affected by CVE-2023-2842?
It affects 1 product.
Products include Wpinventory Wp Inventory Manager.
How do I fix CVE-2023-2842?
No fix has been published for CVE-2023-2842 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-2842 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-2842 exists.
Other vulnerabilities in Unknown WP Inventory Manager
Sources
Also known as GHSA-89r6-wrjm-5xx8.