PT-2023-10290 · WordPress · Wooframework Branding Plugin

Jeffikus · Published 2023-06-05 · Updated 2024-05-17 · CVE-2015-10112

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WooFramework Branding Plugin versions up to 1.0.1

Description A problematic vulnerability has been found in the WooFramework Branding Plugin on WordPress. The issue affects the admin screen logic function of the file wooframework-branding.php. The manipulation of the url argument leads to an open redirect. This attack can be launched remotely.

Recommendations For WooFramework Branding Plugin versions up to 1.0.1, upgrade to version 1.0.2 to address this issue. As a temporary workaround, consider restricting the manipulation of the url argument in the admin screen logic function until the upgrade is applied.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2015-10112

Affected Products

Wooframework Branding Plugin

References · 5

• https://github.com/wp-plugins/wooframework-branding/commit/f12fccd7b5eaf66442346f748c901ef504742f78 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10112 · Security Note
• https://t.me/cibsecurity/64973 · Telegram Post
• https://vuldb.com/?ctiid.230652 · Note
• https://vuldb.com/?id.230652 · Note