5 ms·
> case 'editattachment': > check_admin_referer('update-post_' . $post_id); Seems like you wouldn't be able to actually use this vulnerability without a vali
by claudiulodro 8y ago
> case 'editattachment':
> check_admin_referer('update-post_' . $post_id);
Seems like you wouldn't be able to actually use this vulnerability without a valid nonce, so I don't see how you would trigger this unless you have some sort of malicious plugin also installed on the site . . ?
- joe_hills 8y agoSome sites have plugins that allow users to create accounts with minimal permissions. An attacker could create such an account, then abuse a legitimate nonce to delete files.
- jajern 8y agoNot sure why someone would do this, but even without a plugin you can go to General Settings and set New User Default Role to Author. This would give any new accounts the ability to exploit this.
- claudiulodro 8y agoYeah, I didn't notice the video in the article with the proof-of-concept demonstrates this. Thanks.