The WP Championship WordPress plugin prior to 9.3 is lacking CSRF checks in various places, allowing malicious users to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
wp-championship project wp-championship |
Vulmon