CVE-2019-11886

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.

El plugin WaspThemes Visual CSS Style Editor (alias yellow-pencil-visual-theme-customizer), en versiones anteriores a 7.2.1 para WordPress, permite CSRF en yp_option_update, como lo demuestra el uso de yp_remote_get para obtener acceso de administrador.