CVE-2021-24572: Paypal Donation < 1.3.1 - CSRF to Arbitrary Post Deletion
The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could make logged in admins delete arbitrary posts
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24572?
CVE-2021-24572 is a vulnerability in the Accept Donations with PayPal WordPress plugin before version 1.3.1.
What is the severity of CVE-2021-24572?
The severity of CVE-2021-24572 is medium with a score of 4.3.
How does the Accept Donations with PayPal WordPress plugin create donation buttons?
The Accept Donations with PayPal WordPress plugin creates donation buttons by storing them as posts internally.
Is the deletion of donation buttons CSRF protected in the Accept Donations with PayPal WordPress plugin?
No, the deletion of donation buttons is not CSRF protected in the Accept Donations with PayPal WordPress plugin.
What can an attacker do with CVE-2021-24572?
An attacker could maliciously delete donation buttons without proper control in place.