PT-2023-17638 · WordPress · Buy Me A Coffee – Button/Widget Plugin

István Márton + 1 · Publicado 2023-07-11 · Atualizado 2023-07-18 · CVE-2023-2079

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Buy Me a Coffee – Button and Widget Plugin versions up to, and including, 3.7

Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the recieve post, bmc disconnect, name post, and widget post functions. This allows unauthenticated attackers to update the plugin's settings by tricking a site's administrator into performing an action, such as clicking on a link, via a forged request.

Recommendations For versions up to, and including, 3.7, consider disabling the recieve post, bmc disconnect, name post, and widget post functions until a patch is available to prevent exploitation. Restrict access to the plugin's settings to minimize the risk of unauthorized updates. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-2079

Produtos afetados

Buy Me A Coffee – Button/Widget Plugin

Referências · 7

• 🔥 https://plugins.trac.wordpress.org/browser/buymeacoffee/trunk/includes/class-buy-me-a-coffee.php?rev=2319979#L162 · Exploit
• 🔥 https://plugins.trac.wordpress.org/browser/buymeacoffee/trunk/admin/class-buy-me-a-coffee-admin.php?rev=2816542 · Exploit
• https://wordfence.com/threat-intel/vulnerabilities/id/6309258e-e4fc-4edf-a771-2d82a9a85a5c?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-2079 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2935565%40buymeacoffee&new=2935565%40buymeacoffee&sfp_email=&sfph_mail= · Correção
• https://osv.dev/vulnerability/CVE-2023-2079 · Aviso do Fabricante
• https://t.me/cvenotify/54042 · Publicação no Telegram