[wp-hackers] Rethinking check_admin_referer()

[Andy Skelton]

On 4/18/06, David House <dmhouse at gmail.com> wrote:
> How about this:
>
> 1) Admin writes a post.
> 2) Malicious user leaves a comment with an "image", whose source
> redirecs to http://yoursite.com/wp-admin/post.php?action=delete&post=123
> 3) Admin logs in
> 4) Manage -> Comments
> 5) Post is deleted.
>
> No need to be able to create drafts.

POST method would fix this. Somebody remind me why we are using GET.

Andy