title: Orange Form <= 1.0 - SQL Injection via CSRF
description: In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example
problem types: CWE-89 SQL Injection
affected:
{
product: Orange Form
vendor: Unknown
versions:
lessThanOrEqual: 1.0, status: affected, version: 1.0, versionType: custom
}