CVE-2024-7864

Name of the Vulnerable Software and Affected Versions The Favicon Generator (CLOSED) WordPress plugin versions prior to 2.1

Description The issue concerns a lack of CSRF and path validation in the output sub admin page 0() function. This allows attackers to make logged-in admins delete arbitrary files on the server.

Recommendations For versions prior to 2.1, update to version 2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the output sub admin page 0() function until a patch is available.