CVE-2023-2271

Tiempo.com <= 0.1.2 - Shortcode Deletion via CSRF

The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete arbitrary shortcode via a CSRF attack

Affected

Tiempo.com

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.25% chance of exploitation in the next 30 days, 16th percentile

Published

2023-08-16

Updated

2024-10-08

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/31512f33-c310-4b36-b665-19293097cc8b

References

• CVE Record
• NVD entry