PT-2023-27101 · WordPress · Inisev

Chloe Chamberland

·

Publicado

2023-07-28

·

Atualizado

2025-04-03

·

CVE-2023-3977

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Inisev WordPress plugins (affected versions not specified)
Description The issue allows unauthenticated attackers to install plugins from a limited list via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. This is due to a missing nonce check on the handle installation function that is called via the inisev installation AJAX action in various versions.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-3977

Produtos afetados

Inisev