PT-2019-18275 · Calmar Webmedia+1 · Calmar Webmedia Total Donations+1

Publicado 2019-01-27 · Atualizado 2020-08-24 · CVE-2019-6703

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Calmar Webmedia Total Donations plugin versions through 2.0.5

Description The issue allows unauthenticated attackers to update arbitrary WordPress option values, potentially leading to site takeover. Attackers can send requests to "wp-admin/admin-ajax.php" to call the miglaA update me action, changing arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

Recommendations For Calmar Webmedia Total Donations plugin versions through 2.0.5, update to a version later than 2.0.5 to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin-ajax.php" endpoint or disabling the miglaA update me action to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2019-6703

Produtos afetados

Calmar Webmedia Total Donations

Wordpress

Referências · 4

• 🔥 https://wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-vulnerabilities-in-total-donations-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2019-6703 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6703 · Nota de Segurança
• https://wpvulndb.com/vulnerabilities/9208 · Nota