WordPress Plugin Vulnerabilities

Intimate Payments <= 1.3.1 - CSRF Bypass

Description

The plugin does not properly check for CSRF in its handle_select_currency and handle_update_trx AJAX actions, allowing attacker to make logged in admin call them them via CSRF attacks.

Affects Plugins

Plugin icon
intimate-io-cryptocurrency-payments
No known fix

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
e5fd5e3e-f1c6-4682-8e72-3345be5819a0

Timeline

Publicly Published
2021-06-30 (about 4 years ago)
Added
2021-06-30 (about 4 years ago)
Last Updated
2021-06-30 (about 4 years ago)

Other

Published
Title
Published
2024-05-03
Title
Popup box < 4.1.3 - Cross-Site Request Forgery
Published
2025-08-14
Title
Primer MyData for Woocommerce < 4.2.6 - Cross-Site Request Forgery
Published
2023-04-14
Title
Custom Order Numbers for WooCommerce < 1.4.1 - CSRF
Published
2023-09-29
Title
Instant CSS < 1.2.2 - Theme/CSS/Minify/Preprocessor Data Update via CSRF
Published
2022-05-30
Title
PDF24 Articles To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF