WordPress Plugin Vulnerabilities

ReviewX < 1.2.9 - Unauthorised AJAX call via CSRF

Description

Some of the plugin AJAX actions did not properly check for CRSF nonce, allowing attacker to make users call them and perform unwanted actions.

Affects Plugins

Plugin icon
reviewx
Fixed in 1.2.9

References

URL
https://plugins.trac.wordpress.org/changeset/2503077/

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
381a8abd-6a1c-4b56-8e97-d79a553138fe

Timeline

Publicly Published
2021-06-30 (about 2 years ago)
Added
2021-06-30 (about 2 years ago)
Last Updated
2021-06-30 (about 2 years ago)

Other

Published
Title
Published
2024-04-26
Title
Contact Form 7 Extension For Mailchimp <= 0.5.70 - Cross-Site Request Forgery
Published
2015-04-27
Title
WPS Hide Login 1.0 - CSRF
Published
2023-10-06
Title
Blog Manager Light <= 1.20 - Settings Update via CSRF
Published
2022-09-26
Title
Frontend File Manager < 21.4 - Arbitrary Settings Update via CSRF
Published
2023-10-19
Title
Webpushr < 4.35.0 - LFI via CSRF