PT-2019-12530 · Yuzo · Yuzo Related Posts

Published 2019-05-09 · Updated 2019-05-13 · CVE-2019-11869

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Yuzo Related Posts plugin version 5.12.94

Description The issue arises from the plugin mistakenly assuming that the is admin() function verifies the request origin as an admin user, when in fact it only checks if the request is for an admin page. This allows an unauthenticated attacker to inject malicious payload into the plugin settings, such as the yuzo related post css and style setting.

Recommendations For Yuzo Related Posts plugin version 5.12.94, consider disabling the plugin until a patch is available to prevent potential exploitation. Restrict access to the plugin settings to minimize the risk of malicious payload injection. Avoid using the yuzo related post css and style setting in the plugin until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-11869

Affected Products

Yuzo Related Posts

References · 5

• 🔥 https://wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11869 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11869 · Vendor Advisory
• https://pluginvulnerabilities.com/2019/03/30/wordpress-plugin-team-paints-target-on-exploitable-settings-change-vulnerability-that-permits-persistent-xss-in-related-posts · Note
• https://wpvulndb.com/vulnerabilities/9254 · Note