title: 3DPrint < 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF
description: The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged in admin into submitting a form.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
vendor: Unknown
product: 3dprint
versions:
status: affected, versionType: semver, version: 0, lessThan: 3.5.6.9
defaultStatus: unaffected
}