CVE-2024-7864 — Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF

CVE-2024-7864

Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF PUBLISHED

Description (CNA)

The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server

Affected (CNA)

Vendor / product	Versions
Unknown / Favicon Generator (CLOSED)	affected 0 before 2.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/6ce62e78-04a4-46b2-b97f-c4ef8f3258c3/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.