WordPress Plugin Vulnerabilities

MZ MBO Access < 2.0.9 - Unauthorised AJAX call

Description

The plugin did not properly check for CSRF in some of its AJAX action, allowing attackers to make users unwanted actions.

Affects Plugins

Plugin icon
mindbody-access-management
Fixed in 2.0.9

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
9eb46ab7-a71f-42fb-8ded-fca17c9bf8fd

Timeline

Publicly Published
2021-06-30 (about 4 years ago)
Added
2021-06-30 (about 4 years ago)
Last Updated
2021-06-30 (about 4 years ago)

Other

Published
Title
Published
2022-11-11
Title
AdRotate Banner Manager < 5.9.1 - Password Change via CSRF
Published
2023-07-17
Title
Recipe Maker For Your Food Blog from Zip Recipes < 8.0.8 - Cross-Site Request Forgery
Published
2022-06-06
Title
MyCSS <= 1.1 - Arbitrary Settings Update via CSRF
Published
2025-03-27
Title
EZ SQL Reports Shortcode Widget and DB Backup < 5.25.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-11-28
Title
Yahoo! WebPlayer <= 2.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting