CVE-2020-13426

Опубликовано: 22 июн. 2020

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the possibility of deleting records (users) when an ID is known.

Ссылки

https://0day.today/exploit/34496
Broken Link
https://cxsecurity.com/issue/WLB-2020050235
Exploit
Third Party Advisory
https://infayer.com/archivos/448
Exploit
Third Party Advisory
https://packetstormsecurity.com/files/157867/WordPress-Multi-Scheduler-1.0.0-Cross-Site-Request-Forgery.html
Exploit
Third Party Advisory
VDB Entry
https://research-labs.net/search/exploits/wordpress-plugin-multi-scheduler-100-cross-site-request-forgery-delete-user
Exploit
Third Party Advisory
https://twitter.com/UnD3sc0n0c1d0
Third Party Advisory
https://wordpress.org/plugins/multi-scheduler/#developers
Product
Third Party Advisory
https://www.exploit-db.com/exploits/48532
Exploit
Third Party Advisory
VDB Entry
https://0day.today/exploit/34496
Broken Link
https://cxsecurity.com/issue/WLB-2020050235
Exploit
Third Party Advisory
https://infayer.com/archivos/448
Exploit
Third Party Advisory
https://packetstormsecurity.com/files/157867/WordPress-Multi-Scheduler-1.0.0-Cross-Site-Request-Forgery.html
Exploit
Third Party Advisory
VDB Entry
https://research-labs.net/search/exploits/wordpress-plugin-multi-scheduler-100-cross-site-request-forgery-delete-user
Exploit
Third Party Advisory
https://twitter.com/UnD3sc0n0c1d0
Third Party Advisory
https://wordpress.org/plugins/multi-scheduler/#developers
Product
Third Party Advisory
https://www.exploit-db.com/exploits/48532
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:bdtask:multi-scheduler:1.0.0:*:*:*:*:wordpress:*:*

EPSS

Процентиль: 63%

0.0044

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-m9fr-8jx6-pm3q

github

больше 3 лет назад