PT-2018-17066 · WordPress · Read-And-Understood Plugin

Published 2018-01-13 · Updated 2018-01-23 · CVE-2018-5667

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: read-and-understood plugin version 2.1

Description: A security issue exists in the read-and-understood plugin for WordPress, where cross-site scripting (XSS) is possible. This occurs via the "wp-admin/options-general.php" endpoint, specifically through the rnu username validation pattern parameter.

Recommendations: For read-and-understood plugin version 2.1, update the plugin to a version that fixes this issue or consider disabling the plugin until a patch is available to prevent potential exploitation. As a temporary workaround, restrict access to the "wp-admin/options-general.php" endpoint to minimize the risk of XSS attacks. Avoid using the rnu username validation pattern parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-5667

Affected Products

Read-And-Understood Plugin

References · 3

• 🔥 https://github.com/d4wner/Vulnerabilities-Report/blob/master/read-and-understood.md · Exploit
• https://osv.dev/vulnerability/CVE-2018-5667 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5667 · Security Note