CVE-2022-3899: 
WordPress vulnerability analysis and mitigation

The 3dprint WordPress plugin before version 3.5.6.9 contains a Cross-Site Request Forgery (CSRF) vulnerability in the modified version of Tiny File Manager included with the plugin. This vulnerability was assigned CVE-2022-3899 and was publicly disclosed on November 8, 2022 (WPScan Advisory).

The vulnerability exists due to insufficient CSRF protection in the modified version of Tiny File Manager that comes bundled with the 3dprint WordPress plugin. The CVSS v3.1 base score is 8.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. The vulnerability is classified as CWE-352: Cross-Site Request Forgery (NVD Database).

If exploited, this vulnerability allows an attacker to craft a malicious request that can delete any number of files or directories on the target server by tricking a logged-in administrator into submitting a form. The file path of the files and directories to be deleted is relative to the plugin upload root, 'wp-content/uploads/p3d', and directories are deleted recursively (WPScan Advisory).

The vulnerability has been patched in version 3.5.6.9 of the 3dprint WordPress plugin. Users are advised to update to this version or later to protect against this vulnerability (NVD Database).