Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Background Control 1.0.5版本及之前版本存在跨站请求伪造漏洞。攻击者利用该漏洞可以访问系统上的敏感文件或目录。
WordPress plugin Background Control 跨站请求伪造漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://cve.imfht.com/detail/CVE-2025-22784
https://www.nsfocus.net/vulndb/128547
https://patchstack.com/database/wordpress/plugin/background-control/vulnerability/wordpress-background-control-plugin-1-0-5-csrf-to-arbitrary-file-deletion-vulnerability
https://wpscan.com/vulnerability/d67b7f9b-3a6f-4605-be7a-0a448268cadf/
https://www.cve.org/CVERecord?id=CVE-2025-22784
https://www.sentinelone.com/vulnerability-database/cve-2025-22784/
https://github.com/advisories/GHSA-396f-r23h-8cqv