CVE-2022-44630 – YITH plugins by YITHEMES <= (Various Versions) - Cross-Site Request Forgery

https://notcve.org/view.php?id=CVE-2022-44630

Several YITHEMES plugins for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the create_log_file function. This makes it possible for unauthenticated attackers to create an error or debug log file using the plugin, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. The function allows the user to specify the file name. Please note that the unpatched plugins from this developer are the FREE versions of the plugin that were available on the WordPress.org repository. • CWE-352: Cross-Site Request Forgery (CSRF) •