Описание
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin settings by tricking admin users into visiting specially crafted websites.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.4 (исключая)
cpe:2.3:a:wpexperts:new_user_approve:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 29%
0.00103
Низкий
4.3 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-352
CWE-352
Связанные уязвимости
CVSS3: 4.3
github
больше 3 лет назад
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin settings by tricking admin users into visiting specially crafted websites.
EPSS
Процентиль: 29%
0.00103
Низкий
4.3 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-352
CWE-352