title: Fileviewer <= 2.2 - Arbitrary File Upload/Deletion via CSRF
description: The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers could make a logged in administrator delete and upload arbitrary files via a CSRF attack
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
product: Fileviewer
vendor: Unknown
versions:
lessThanOrEqual: 2.2, status: affected, version: 2.2, versionType: custom
}