CVE-2020-25263

Name of the Vulnerable Software and Affected Versions PyroCMS version 3.7

Description The issue allows for cross-site request forgery (CSRF) via the "admin/addons/uninstall/anomaly.module.blocks" URI, which can lead to the deletion of an arbitrary plugin.

Recommendations For PyroCMS version 3.7, as a temporary workaround, consider restricting access to the "admin/addons/uninstall/anomaly.module.blocks" URI to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.