漏洞描述
The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
wordpress.orghttps://wordpress.org/plugins/yellow-pencil-visual-theme-customizer/#developers↗wpvulndb.comhttps://wpvulndb.com/vulnerabilities/9256↗www.pluginvulnerabilities.comhttps://www.pluginvulnerabilities.com/2019/04/09/recently-closed-visual-css-style-editor-wordpress-plugin-contains-privilege-escalation-vulnerability-that-leads-to-option-update-vulnerability/↗