PT-2022-9652 · WordPress · Labtools

Itsfading + 1 · Published 2022-02-01 · Updated 2022-12-09 · CVE-2021-25097

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions LabTools WordPress plugin versions 1.0 and earlier

Description The issue concerns a lack of proper authorization and CSRF check when deleting publications. This allows any authenticated users, such as subscribers, to delete arbitrary publications.

Recommendations For LabTools WordPress plugin versions 1.0 and earlier, update to a version that includes proper authorization and CSRF checks for publication deletion. As a temporary workaround, consider restricting publication deletion capabilities to only trusted users until a patch is available.

Fix

Incorrect Authorization

CSRF

Weakness Enumeration

CWE-863

CWE-352

Related Identifiers

CVE-2021-25097

Affected Products

Labtools

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-25097 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25097 · Vendor Advisory
• https://t.me/cibsecurity/36631 · Telegram Post
• https://t.me/cvenotify/26101 · Telegram Post
• https://t.me/cvenotify/37167 · Telegram Post
• https://wpscan.com/vulnerability/67f5beb8-2cb0-4b43-87c7-dead9c005f9c · Note