CVE-2021-25097

MEDIUM

LabTools < 1.0 - Authenticated Cross-Site Request Forgery in Publication Deletion

Title source: llm
STIX 2.1

Description

The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication

References (1)

Core 1

Scores

CVSS v3 6.5
EPSS 0.0038
EPSS Percentile 30.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-352 CWE-863
Status published
Products (1)
creativityjuice/labtools < 1.0
Published Feb 01, 2022
Tracked Since Feb 18, 2026