PT-2019-13825 · WordPress · Woody Ad Snippets

Publicado 2019-08-08 · Atualizado 2020-08-24 · CVE-2019-14773

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Woody ad snippets plugin versions prior to 2.2.6

Description The issue concerns the "Woody ad snippets" plugin for WordPress, where a problem in the admin/includes/class.actions.snippet.php file allows unauthorized post deletion through the wp-admin/admin-post.php action. Specifically, the API endpoint '/wp-admin/admin-post.php' with the action 'close' and the parameter post can be exploited.

Recommendations For Woody ad snippets plugin versions prior to 2.2.6, update to version 2.2.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the /wp-admin/admin-post.php endpoint with the action parameter set to 'close' and the post parameter until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2019-14773

Produtos afetados

Woody Ad Snippets

Referências · 4

• 🔥 https://pluginvulnerabilities.com/2019/08/01/post-deletion-vulnerability-in-woody-ad-snippets · Exploit
• https://wordpress.org/plugins/insert-php/#developers · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-14773 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-14773 · Aviso do Fabricante