PT-2022-9661 · WordPress · Wplegalpages

Krzysztof Zając · Published 2022-02-07 · Updated 2022-02-11 · CVE-2021-25106

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WPLegalPages WordPress plugin versions prior to 2.7.1

Description The issue arises from the plugin's failure to check for authorization and its flawed CSRF logic when saving settings, allowing any authenticated user to update them. Additionally, the lack of sanitization and escaping can lead to Stored Cross-Site Scripting.

Recommendations For versions prior to 2.7.1, update to version 2.7.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings page to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25106

Affected Products

Wplegalpages

References · 4

• 🔥 https://wpscan.com/vulnerability/47df802d-5200-484b-959c-9f569edf992e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25106 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25106 · Vendor Advisory
• https://t.me/cvenotify/26613 · Telegram Post