PT-2023-19837 · WordPress · Greeklish-Permalink

Jonas Höbenreich · Publicado 2023-07-10 · Atualizado 2023-07-17 · CVE-2023-2495

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Greeklish-permalink WordPress plugin versions prior to 3.4

Description The issue concerns the lack of proper authorization and nonce checks in the cyrtrans ajax old AJAX action. This allows unauthorized and low-privilege users to change Post slugs, either directly or through Cross-Site Request Forgery (CSRF).

Recommendations For Greeklish-permalink WordPress plugin versions prior to 3.4, update to version 3.4 or later to resolve the issue. As a temporary workaround, consider disabling the cyrtrans ajax old AJAX action until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the plugin's features that rely on the vulnerable AJAX action until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2023-2495

Produtos afetados

Greeklish-Permalink

Referências · 3

• 🔥 https://wpscan.com/vulnerability/45878983-7e9b-49c2-8f99-4c28aab24f09 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2495 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-2495 · Aviso do Fabricante