Description
The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. This is due to missing or incorrect nonce validation on the aDBc_prepare_elements_to_clean() function. This makes it possible for unauthenticated attackers to alter the keep last setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types
CWE-20 Improper Input Validation
Product status
* (semver)
Timeline
| 2025-10-24: | Disclosed |
Credits
Bao - BlueRock
References
www.wordfence.com/...-2ce6-4135-8d2b-d03b42860f05?source=cve
plugins.trac.wordpress.org/...-cleaner&sfp_email=&sfph_mail=
