PT-2023-10291 · WordPress · Wooframework Tweaks Plugin

Jeffikus · Published 2023-06-05 · Updated 2024-05-17 · CVE-2015-10113

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WooFramework Tweaks Plugin versions up to 1.0.1

Description A vulnerability was found in the WooFramework Tweaks Plugin on WordPress. The issue affects the admin screen logic function of the file wooframework-tweaks.php. The manipulation of the url argument leads to an open redirect. This attack can be launched remotely.

Recommendations For WooFramework Tweaks Plugin versions up to 1.0.1, upgrade to version 1.0.2 to address this issue. As a temporary workaround, consider restricting access to the admin screen logic function until the update is applied. Avoid using the url argument in the affected function to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2015-10113

Affected Products

Wooframework Tweaks Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-10113 · Security Note
• https://github.com/wp-plugins/wooframework-tweaks/commit/3b57d405149c1a59d1119da6e0bb8212732c9c88 · Patch
• https://vuldb.com/?id.230653 · Note
• https://t.me/cvenotify/51770 · Telegram Post
• https://vuldb.com/?ctiid.230653 · Note
• https://t.me/cibsecurity/64985 · Telegram Post