Throws SPAM Away < 3.3.1 - Comment Deletion via CSRF

An attacker crafts a malicious link or form that, when visited by a logged-in administrator, triggers a comment deletion request to the WordPress site running the vulnerable plugin. Because the plugin lacks CSRF nonce checks on its comment deletion endpoints, the browser automatically includes the admin's session cookies, making the request appear legitimate [CWE-352]. The attacker can force the deletion of all comments, spam comments, or pending comments without the admin's consent [ref_id=1].

The advisory does not specify exact file paths or function names. The vulnerability exists in the comment deletion functionality of the Throws SPAM Away WordPress plugin, specifically the actions that handle deleting all comments, spam comments, or pending comments [ref_id=1].

The advisory states the vulnerability is fixed in version 3.3.1 of the Throws SPAM Away plugin [ref_id=1]. The patch is not included in the bundle, but based on the nature of the vulnerability, the fix likely adds CSRF nonce verification to the comment deletion actions, ensuring that requests originate from the legitimate admin interface rather than from an external attacker-controlled page.