title: Custom Post Type UI < 1.13.5 - Debug Info Sending via CSRF
description: The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
vendor: Unknown
product: Custom Post Type UI
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.13.5
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}