PT-2014-5714 · WordPress · Featured Comments

Tom Adams · Published 2014-06-16 · Updated 2014-06-17 · CVE-2014-4163

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Featured Comments plugin version 1.2.1 for WordPress

Description The issue allows remote attackers to hijack the authentication of administrators for requests that change the buried or featured status of a comment. This is achieved via a request to "wp-admin/admin-ajax.php".

Recommendations For Featured Comments plugin version 1.2.1, update to a version that addresses the CSRF vulnerabilities to prevent authentication hijacking.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-4163

Affected Products

Featured Comments

References · 4

• 🔥 https://exploit-db.com/exploits/39213 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Jun/62 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4163 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4163 · Note