PT-2019-12533 · WordPress · The Hustle

Published 2019-05-29 · Updated 2023-02-24 · CVE-2019-11872

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Hustle (aka wordpress-popup) plugin version 6.0.7

Description The issue allows for injecting malicious code into a pop-up window, potentially granting an attacker the ability to execute malicious code on the administrator's computer through Excel functions. This is due to the plugin's failure to sanitize user input, allowing the insertion of any text.

Recommendations For version 6.0.7, consider disabling the plugin until a patch is available to prevent potential exploitation. Restrict access to the plugin's functionality to minimize the risk of malicious code injection. Avoid using the plugin to insert untrusted text into pop-up windows until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2019-11872

Affected Products

The Hustle

References · 6

• 🔥 https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin · Exploit
• 🔥 https://blog.reddy.io/category/cybersecurity · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11872 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11872 · Vendor Advisory
• https://wordpress.org/plugins/wordpress-popup/#developers · Note
• https://wpvulndb.com/vulnerabilities/9326 · Note