CVEs-PoC/2020/CVE-2020-36504.md

### [CVE-2020-36504](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36504)
![](https://img.shields.io/static/v1?label=Product&message=Wp-Pro-Quiz&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0.37%3C%3D%200.37%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brighgreen)

### Description

The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin delete arbitrary quiz on the blog

### POC

#### Reference
- https://medium.com/@hoanhp/0-days-story-1-wp-pro-quiz-2115dd77a6d4
- https://wpscan.com/vulnerability/83679b90-faa5-454e-924c-89f388eccbd1

#### Github
No PoCs found on GitHub currently.