Description
WordPress Plugin VM Backups is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible. WordPress Plugin VM Backups version 1.0 is vulnerable.
Remediation
Edit the source code to ensure that CSRF protection is implemented with Nonce-like mechanism or disable the plugin until a fix is available
References
https://sploitus.com/exploit?id=WPEX-ID:187E6967-6961-4843-A9D5-866F6EBDB7BC
https://sploitus.com/exploit?id=WPEX-ID:B69EA1BC-3C9B-47D7-A164-C860EE46A9AF
Related Vulnerabilities
Moodle Improper Access Control Vulnerability (CVE-2015-2267)
WordPress Plugin FV Flowplayer Video Player Cross-Site Scripting (7.3.13.727)
Envoy Proxy Use After Free Vulnerability (CVE-2024-34362)
Oracle Database Server CVE-2019-2547 Vulnerability (CVE-2019-2547)
WordPress Plugin Infographic Maker-iList Unspecified Vulnerability (2.7.0)