PT-2015-5329 · WordPress · Fancybox

Areohdeee + 11 · Published 2015-02-17 · Updated 2021-09-13 · CVE-2015-1494

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FancyBox for WordPress versions prior to 3.0.3

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a mfbfw[*] parameter in an update action to "wp-admin/admin-post.php". This has been exploited in the wild, as demonstrated by the mfbfw[padding] parameter.

Recommendations For versions prior to 3.0.3, update to version 3.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin-post.php" endpoint to minimize the risk of exploitation. Avoid using the mfbfw[*] parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-1494

Affected Products

Fancybox

References · 11

• 🔥 https://exploit-db.com/exploits/36087 · Exploit
• 🔥 http://exploit-db.com/exploits/36087 · Exploit
• 🔥 https://wordpress.org/support/topic/possible-malware-2 · Exploit
• https://wordpress.org/plugins/fancybox-for-wordpress/changelog · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-1494 · Security Note
• http://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugin.html · Note
• https://plugins.trac.wordpress.org/changeset/1082625 · Note
• http://openwall.com/lists/oss-security/2015/02/05/10 · Note
• http://securityfocus.com/bid/72506 · Note
• http://osvdb.org/show/osvdb/118543 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1494 · Note