PT-2023-19837 · WordPress · Greeklish-Permalink

Jonas Höbenreich · Published 2023-07-10 · Updated 2023-07-17 · CVE-2023-2495

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Greeklish-permalink WordPress plugin versions prior to 3.4

Description The issue concerns the lack of proper authorization and nonce checks in the cyrtrans ajax old AJAX action. This allows unauthorized and low-privilege users to change Post slugs, either directly or through Cross-Site Request Forgery (CSRF).

Recommendations For Greeklish-permalink WordPress plugin versions prior to 3.4, update to version 3.4 or later to resolve the issue. As a temporary workaround, consider disabling the cyrtrans ajax old AJAX action until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the plugin's features that rely on the vulnerable AJAX action until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2023-2495

Affected Products

Greeklish-Permalink

References · 3

• 🔥 https://wpscan.com/vulnerability/45878983-7e9b-49c2-8f99-4c28aab24f09 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2495 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2495 · Vendor Advisory