hiWeb Export Posts WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Arbitrary File Deletion

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the hiWeb Export Posts plugin for WordPress, affecting all versions up to and including 0.9.0.0. The vulnerability arises from inadequate nonce validation in the tool-dashboard-history.php file, enabling unauthenticated attackers to delete arbitrary files from the server. This file deletion could lead to remote code execution, particularly if a critical file like wp-config.php is removed, especially if an administrator is tricked into clicking a link that initiates the deletion.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion on the server, which could be leveraged for remote code execution, particularly if sensitive files are targeted.