Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF

Vulnerability

The Favicon Generator (CLOSED) WordPress plugin versions before 2.1 are vulnerable to an arbitrary file deletion issue. The plugin fails to implement Cross-Site Request Forgery (CSRF) protection and does not validate the file path in the output_sub_admin_page_0() function. This allows an attacker to craft a malicious request that, when executed by a logged-in administrator, can delete any file on the server [1].

Exploitation

An attacker must trick a logged-in administrator into visiting a malicious page or clicking a crafted link. No authentication is required for the attacker, but the victim must have administrator privileges. The exploit leverages the missing CSRF token and insufficient path validation to send a forged request to the vulnerable function, specifying an arbitrary file path to delete [1].

Impact

Successful exploitation leads to arbitrary file deletion on the server. This can result in denial of service, destruction of critical WordPress files (e.g., wp-config.php), or removal of user-uploaded content. The attacker does not gain direct code execution but can severely disrupt site functionality [1].

Mitigation

The vulnerability is fixed in version 2.1 of the plugin. Administrators should update the Favicon Generator plugin to version 2.1 or later immediately. If updating is not possible, consider disabling the plugin until a patch is applied. No other workarounds are currently available [1].