Description
In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges.
Remediation
References
Related Vulnerabilities
WordPress Plugin SEO Redirection-301 Redirect Manager Cross-Site Request Forgery (8.9)
WordPress Plugin 2 Click Social Media Buttons 'xing-url' Parameter Cross-Site Scripting (0.32.2)
WordPress Plugin Contentboxes Cross-Site Scripting (1.1)
WordPress Plugin WebP Express Arbitrary File Disclosure (0.14.10)