PT-2023-18652 · WordPress · Tiempo.Com Wordpress Plugin

Erwan Lr · Published 2023-08-16 · Updated 2023-08-22 · CVE-2023-2271

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tiempo.com WordPress plugin versions 0.1.2 and earlier

Description The issue is related to the lack of a CSRF check when deleting a shortcode in the Tiempo.com WordPress plugin. This could allow attackers to make logged-in admins delete arbitrary shortcodes via a CSRF attack.

Recommendations For versions 0.1.2 and earlier, update to a version that includes a CSRF check for shortcode deletion to prevent this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-2271

Affected Products

Tiempo.Com Wordpress Plugin

References · 8

• 🔥 https://wpscan.com/vulnerability/31512f33-c310-4b36-b665-19293097cc8b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2271 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2271 · Vendor Advisory
• https://twitter.com/TechFishNews/status/1691822684970312186 · Twitter Post
• https://t.me/cvenotify/56591 · Telegram Post
• https://t.me/cvenotify/57079 · Telegram Post
• https://t.me/cibsecurity/68636 · Telegram Post
• https://twitter.com/CVEnew/status/1691770045511225489 · Twitter Post