WordPress Plugin Vulnerabilities

Companion Auto Update <= 3.2.0 - CSRF & LFI

Description

The Companion Auto Update WordPress plugin was affected by a CSRF & LFI security vulnerability.

Affects Plugins

Plugin icon
companion-auto-update
Fixed in 3.2.1

References

CVE
CVE-2018-20973
CVE
CVE-2018-20972
URL
https://plugins.trac.wordpress.org/changeset?reponame=&new=1950074%40companion-auto-update&old=1923374%40companion-auto-update

Miscellaneous

Verified
No
WPVDB ID
f46fc0d2-d018-46b1-9874-176d57cedb71

Timeline

Publicly Published
2018-10-02 (about 7 years ago)
Added
2019-06-28 (about 6 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2014-08-01
Title
RokMicroNews <= 1.5 - XSS,DoS,Disclosure,Upload Vulnerabilities
Published
2015-09-01
Title
Testimonial Slider < 1.3.2 - Authenticated Stored Cross-Site Scripting (XSS) & CSRF
Published
2015-07-07
Title
NewStatPress < 1.0.6 - SQL Injection
Published
2020-08-20
Title
Discount Rules for WooCommerce < 2.1.0 - Multiple Vulnerabilities
Published
2019-06-15
Title
Dropshix < 4.0.14 - Arbitrary Product Import