Findings
- Allows deleting arbitrary files upon a POST request by any user. This request doesn’t use any kind of CSRF protection so it’s possible for attackers who aren’t users to do it too.
- No CSRF protection on some POST requests, which may allow the plugin to be exploitable in other ways.
Reason for the 'Potentially unsafe' result
The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:
An attacker can delete any file the PHP process can delete.
For this to happen, a logged-in user would have to be tricked into clicking on a link controlled by the attacker. It is easy to make these links very convincin