Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
Vulnerability Description
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.
CVSS Information
N/A
Vulnerability Type
授权机制缺失
Vulnerability Title
WordPress plugin OMGF 访问控制错误漏洞
Vulnerability Description
WordPress是Wordpress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress 插件是WordPress开源的一个应用插件。 OMGF WordPress插件存在安全漏洞，该漏洞源于OMGF WordPress插件在OMGF ajax空目录ajax操作中不强制执行路径验证、授权和CSRF检查，这允许任何认证用户删除服务器上的任意文件或文件夹。
CVSS Information
N/A
Vulnerability Type
N/A