Tgianko

The issue allows remote attackers to hijack the authentication of admins for requests. This can lead to creating new administrator user accounts and taking over the entire application, creating regular user accounts, or changing configuration parameters such as tax rates and the enable/disable status of PayPal payment modules.

The issue allows remote attackers to hijack the authentication of users for requests that delete email campaigns or delete contacts due to multiple cross-site request forgery (CSRF) vulnerabilities.