WordPress Vulnerabilities

WP < 6.2.1 - Thumbnail Image Update via CSRF

Description

WordPress does not have CSRF check when updating the thumbnail image associated with existing attachments, which could allow attackers to make logged in admins update them via a CSRF attack

Affects WordPress

6.2
Fixed in WordPress 6.2.1
6.1.1
Fixed in WordPress 6.1.2
6.1
Fixed in WordPress 6.1.2
6.0.3
Fixed in WordPress 6.0.4
6.0.2
Fixed in WordPress 6.0.4
6.0.1
Fixed in WordPress 6.0.4
6.0
Fixed in WordPress 6.0.4
5.9.5
Fixed in WordPress 5.9.6
5.9.4
Fixed in WordPress 5.9.6
5.9.3
Fixed in WordPress 5.9.6
5.9.2
Fixed in WordPress 5.9.6
5.9.1
Fixed in WordPress 5.9.6
5.9
Fixed in WordPress 5.9.6
5.8.6
Fixed in WordPress 5.8.7
5.8.5
Fixed in WordPress 5.8.7
5.8.4
Fixed in WordPress 5.8.7
5.8.3
Fixed in WordPress 5.8.7
5.8.2
Fixed in WordPress 5.8.7
5.8.1
Fixed in WordPress 5.8.7
5.8
Fixed in WordPress 5.8.7
5.6.10
Fixed in WordPress 5.6.11
5.6.9
Fixed in WordPress 5.6.11
5.6.8
Fixed in WordPress 5.6.11
5.6.7
Fixed in WordPress 5.6.11
5.6.6
Fixed in WordPress 5.6.11
5.6.5
Fixed in WordPress 5.6.11
5.6.4
Fixed in WordPress 5.6.11
5.6.3
Fixed in WordPress 5.6.11
5.6.2
Fixed in WordPress 5.6.11
5.6.1
Fixed in WordPress 5.6.11
5.6
Fixed in WordPress 5.6.11
5.5.11
Fixed in WordPress 5.5.12
5.5.10
Fixed in WordPress 5.5.12
5.5.9
Fixed in WordPress 5.5.12
5.5.8
Fixed in WordPress 5.5.12
5.5.7
Fixed in WordPress 5.5.12
5.5.6
Fixed in WordPress 5.5.12
5.5.5
Fixed in WordPress 5.5.12
5.5.4
Fixed in WordPress 5.5.12
5.5.3
Fixed in WordPress 5.5.12
5.5.2
Fixed in WordPress 5.5.12
5.5.1
Fixed in WordPress 5.5.12
5.5
Fixed in WordPress 5.5.12
5.4.12
Fixed in WordPress 5.4.13
5.4.11
Fixed in WordPress 5.4.13
5.4.10
Fixed in WordPress 5.4.13
5.4.9
Fixed in WordPress 5.4.13
5.4.8
Fixed in WordPress 5.4.13
5.4.7
Fixed in WordPress 5.4.13
5.4.6
Fixed in WordPress 5.4.13
5.4.5
Fixed in WordPress 5.4.13
5.4.4
Fixed in WordPress 5.4.13
5.4.3
Fixed in WordPress 5.4.13
5.4.2
Fixed in WordPress 5.4.13
5.4.1
Fixed in WordPress 5.4.13
5.4
Fixed in WordPress 5.4.13
5.3.14
Fixed in WordPress 5.3.15
5.3.13
Fixed in WordPress 5.3.15
5.3.12
Fixed in WordPress 5.3.15
5.3.11
Fixed in WordPress 5.3.15
5.3.10
Fixed in WordPress 5.3.15
5.3.9
Fixed in WordPress 5.3.15
5.3.8
Fixed in WordPress 5.3.15
5.3.7
Fixed in WordPress 5.3.15
5.3.6
Fixed in WordPress 5.3.15
5.3.5
Fixed in WordPress 5.3.15
5.3.4
Fixed in WordPress 5.3.15
5.3.3
Fixed in WordPress 5.3.15
5.3.2
Fixed in WordPress 5.3.15
5.3.1
Fixed in WordPress 5.3.15
5.3
Fixed in WordPress 5.3.15
5.2.17
Fixed in WordPress 5.2.18
5.2.16
Fixed in WordPress 5.2.18
5.2.15
Fixed in WordPress 5.2.18
5.2.14
Fixed in WordPress 5.2.18
5.2.13
Fixed in WordPress 5.2.18
5.2.12
Fixed in WordPress 5.2.18
5.2.11
Fixed in WordPress 5.2.18
5.2.10
Fixed in WordPress 5.2.18
5.2.9
Fixed in WordPress 5.2.18
5.2.8
Fixed in WordPress 5.2.18
5.2.7
Fixed in WordPress 5.2.18
5.2.6
Fixed in WordPress 5.2.18
5.2.5
Fixed in WordPress 5.2.18
5.2.4
Fixed in WordPress 5.2.18
5.2.3
Fixed in WordPress 5.2.18
5.2.2
Fixed in WordPress 5.2.18
5.2.1
Fixed in WordPress 5.2.18
5.2
Fixed in WordPress 5.2.18
5.1.15
Fixed in WordPress 5.1.16
5.1.14
Fixed in WordPress 5.1.16
5.1.13
Fixed in WordPress 5.1.16
5.1.12
Fixed in WordPress 5.1.16
5.1.11
Fixed in WordPress 5.1.16
5.1.10
Fixed in WordPress 5.1.16
5.1.9
Fixed in WordPress 5.1.16
5.1.8
Fixed in WordPress 5.1.16
5.1.7
Fixed in WordPress 5.1.16
5.1.6
Fixed in WordPress 5.1.16
5.1.5
Fixed in WordPress 5.1.16
5.1.4
Fixed in WordPress 5.1.16
5.1.3
Fixed in WordPress 5.1.16
5.1.2
Fixed in WordPress 5.1.16
5.1.1
Fixed in WordPress 5.1.16
5.1
Fixed in WordPress 5.1.16
5.0.18
Fixed in WordPress 5.0.19
5.0.17
Fixed in WordPress 5.0.19
5.0.16
Fixed in WordPress 5.0.19
5.0.15
Fixed in WordPress 5.0.19
5.0.14
Fixed in WordPress 5.0.19
5.0.13
Fixed in WordPress 5.0.19
5.0.12
Fixed in WordPress 5.0.19
5.0.11
Fixed in WordPress 5.0.19
5.0.10
Fixed in WordPress 5.0.19
5.0.9
Fixed in WordPress 5.0.19
5.0.8
Fixed in WordPress 5.0.19
5.0.7
Fixed in WordPress 5.0.19
5.0.6
Fixed in WordPress 5.0.19
5.0.4
Fixed in WordPress 5.0.19
5.0.3
Fixed in WordPress 5.0.19
5.0.2
Fixed in WordPress 5.0.19
5.0.1
Fixed in WordPress 5.0.19
5.0
Fixed in WordPress 5.0.19
4.9.22
Fixed in WordPress 4.9.23
4.9.21
Fixed in WordPress 4.9.23
4.9.20
Fixed in WordPress 4.9.23
4.9.19
Fixed in WordPress 4.9.23
4.9.18
Fixed in WordPress 4.9.23
4.9.17
Fixed in WordPress 4.9.23
4.9.16
Fixed in WordPress 4.9.23
4.9.15
Fixed in WordPress 4.9.23
4.9.14
Fixed in WordPress 4.9.23
4.9.13
Fixed in WordPress 4.9.23
4.9.12
Fixed in WordPress 4.9.23
4.9.11
Fixed in WordPress 4.9.23
4.9.10
Fixed in WordPress 4.9.23
4.9.9
Fixed in WordPress 4.9.23
4.9.8
Fixed in WordPress 4.9.23
4.9.7
Fixed in WordPress 4.9.23
4.9.6
Fixed in WordPress 4.9.23
4.9.5
Fixed in WordPress 4.9.23
4.9.4
Fixed in WordPress 4.9.23
4.9.3
Fixed in WordPress 4.9.23
4.9.2
Fixed in WordPress 4.9.23
4.9.1
Fixed in WordPress 4.9.23
4.9
Fixed in WordPress 4.9.23
4.8.21
Fixed in WordPress 4.8.22
4.8.20
Fixed in WordPress 4.8.22
4.8.19
Fixed in WordPress 4.8.22
4.8.18
Fixed in WordPress 4.8.22
4.8.17
Fixed in WordPress 4.8.22
4.8.16
Fixed in WordPress 4.8.22
4.8.15
Fixed in WordPress 4.8.22
4.8.14
Fixed in WordPress 4.8.22
4.8.13
Fixed in WordPress 4.8.22
4.8.12
Fixed in WordPress 4.8.22
4.8.11
Fixed in WordPress 4.8.22
4.8.10
Fixed in WordPress 4.8.22
4.8.9
Fixed in WordPress 4.8.22
4.8.8
Fixed in WordPress 4.8.22
4.8.7
Fixed in WordPress 4.8.22
4.8.6
Fixed in WordPress 4.8.22
4.8.5
Fixed in WordPress 4.8.22
4.8.4
Fixed in WordPress 4.8.22
4.8.3
Fixed in WordPress 4.8.22
4.8.2
Fixed in WordPress 4.8.22
4.8.1
Fixed in WordPress 4.8.22
4.8
Fixed in WordPress 4.8.22
4.7.25
Fixed in WordPress 4.7.26
4.7.24
Fixed in WordPress 4.7.26
4.7.23
Fixed in WordPress 4.7.26
4.7.22
Fixed in WordPress 4.7.26
4.7.21
Fixed in WordPress 4.7.26
4.7.20
Fixed in WordPress 4.7.26
4.7.19
Fixed in WordPress 4.7.26
4.7.18
Fixed in WordPress 4.7.26
4.7.17
Fixed in WordPress 4.7.26
4.7.16
Fixed in WordPress 4.7.26
4.7.15
Fixed in WordPress 4.7.26
4.7.14
Fixed in WordPress 4.7.26
4.7.13
Fixed in WordPress 4.7.26
4.7.12
Fixed in WordPress 4.7.26
4.7.11
Fixed in WordPress 4.7.26
4.7.10
Fixed in WordPress 4.7.26
4.7.9
Fixed in WordPress 4.7.26
4.7.8
Fixed in WordPress 4.7.26
4.7.7
Fixed in WordPress 4.7.26
4.7.6
Fixed in WordPress 4.7.26
4.7.5
Fixed in WordPress 4.7.26
4.7.4
Fixed in WordPress 4.7.26
4.7.3
Fixed in WordPress 4.7.26
4.7.2
Fixed in WordPress 4.7.26
4.7.1
Fixed in WordPress 4.7.26
4.7
Fixed in WordPress 4.7.26
4.6.25
Fixed in WordPress 4.6.26
4.6.24
Fixed in WordPress 4.6.26
4.6.23
Fixed in WordPress 4.6.26
4.6.22
Fixed in WordPress 4.6.26
4.6.21
Fixed in WordPress 4.6.26
4.6.20
Fixed in WordPress 4.6.26
4.6.19
Fixed in WordPress 4.6.26
4.6.18
Fixed in WordPress 4.6.26
4.6.17
Fixed in WordPress 4.6.26
4.6.16
Fixed in WordPress 4.6.26
4.6.15
Fixed in WordPress 4.6.26
4.6.14
Fixed in WordPress 4.6.26
4.6.13
Fixed in WordPress 4.6.26
4.6.12
Fixed in WordPress 4.6.26
4.6.11
Fixed in WordPress 4.6.26
4.6.10
Fixed in WordPress 4.6.26
4.6.9
Fixed in WordPress 4.6.26
4.6.8
Fixed in WordPress 4.6.26
4.6.7
Fixed in WordPress 4.6.26
4.6.6
Fixed in WordPress 4.6.26
4.6.5
Fixed in WordPress 4.6.26
4.6.4
Fixed in WordPress 4.6.26
4.6.3
Fixed in WordPress 4.6.26
4.6.2
Fixed in WordPress 4.6.26
4.6.1
Fixed in WordPress 4.6.26
4.6
Fixed in WordPress 4.6.26
4.5.28
Fixed in WordPress 4.5.29
4.5.27
Fixed in WordPress 4.5.29
4.5.26
Fixed in WordPress 4.5.29
4.5.25
Fixed in WordPress 4.5.29
4.5.24
Fixed in WordPress 4.5.29
4.5.23
Fixed in WordPress 4.5.29
4.5.22
Fixed in WordPress 4.5.29
4.5.21
Fixed in WordPress 4.5.29
4.5.20
Fixed in WordPress 4.5.29
4.5.19
Fixed in WordPress 4.5.29
4.5.18
Fixed in WordPress 4.5.29
4.5.17
Fixed in WordPress 4.5.29
4.5.16
Fixed in WordPress 4.5.29
4.5.15
Fixed in WordPress 4.5.29
4.5.14
Fixed in WordPress 4.5.29
4.5.13
Fixed in WordPress 4.5.29
4.5.12
Fixed in WordPress 4.5.29
4.5.11
Fixed in WordPress 4.5.29
4.5.10
Fixed in WordPress 4.5.29
4.5.9
Fixed in WordPress 4.5.29
4.5.8
Fixed in WordPress 4.5.29
4.5.7
Fixed in WordPress 4.5.29
4.5.6
Fixed in WordPress 4.5.29
4.5.5
Fixed in WordPress 4.5.29
4.5.4
Fixed in WordPress 4.5.29
4.5.3
Fixed in WordPress 4.5.29
4.5.2
Fixed in WordPress 4.5.29
4.5.1
Fixed in WordPress 4.5.29
4.5
Fixed in WordPress 4.5.29
4.4.29
Fixed in WordPress 4.4.30
4.4.28
Fixed in WordPress 4.4.30
4.4.27
Fixed in WordPress 4.4.30
4.4.26
Fixed in WordPress 4.4.30
4.4.25
Fixed in WordPress 4.4.30
4.4.24
Fixed in WordPress 4.4.30
4.4.23
Fixed in WordPress 4.4.30
4.4.22
Fixed in WordPress 4.4.30
4.4.21
Fixed in WordPress 4.4.30
4.4.20
Fixed in WordPress 4.4.30
4.4.19
Fixed in WordPress 4.4.30
4.4.18
Fixed in WordPress 4.4.30
4.4.17
Fixed in WordPress 4.4.30
4.4.16
Fixed in WordPress 4.4.30
4.4.15
Fixed in WordPress 4.4.30
4.4.14
Fixed in WordPress 4.4.30
4.4.13
Fixed in WordPress 4.4.30
4.4.12
Fixed in WordPress 4.4.30
4.4.11
Fixed in WordPress 4.4.30
4.4.10
Fixed in WordPress 4.4.30
4.4.9
Fixed in WordPress 4.4.30
4.4.8
Fixed in WordPress 4.4.30
4.4.7
Fixed in WordPress 4.4.30
4.4.6
Fixed in WordPress 4.4.30
4.4.5
Fixed in WordPress 4.4.30
4.4.4
Fixed in WordPress 4.4.30
4.4.3
Fixed in WordPress 4.4.30
4.4.2
Fixed in WordPress 4.4.30
4.4.1
Fixed in WordPress 4.4.30
4.4
Fixed in WordPress 4.4.30
4.3.30
Fixed in WordPress 4.3.31
4.3.29
Fixed in WordPress 4.3.31
4.3.28
Fixed in WordPress 4.3.31
4.3.27
Fixed in WordPress 4.3.31
4.3.26
Fixed in WordPress 4.3.31
4.3.25
Fixed in WordPress 4.3.31
4.3.24
Fixed in WordPress 4.3.31
4.3.23
Fixed in WordPress 4.3.31
4.3.22
Fixed in WordPress 4.3.31
4.3.21
Fixed in WordPress 4.3.31
4.3.20
Fixed in WordPress 4.3.31
4.3.19
Fixed in WordPress 4.3.31
4.3.18
Fixed in WordPress 4.3.31
4.3.17
Fixed in WordPress 4.3.31
4.3.16
Fixed in WordPress 4.3.31
4.3.15
Fixed in WordPress 4.3.31
4.3.14
Fixed in WordPress 4.3.31
4.3.13
Fixed in WordPress 4.3.31
4.3.12
Fixed in WordPress 4.3.31
4.3.11
Fixed in WordPress 4.3.31
4.3.10
Fixed in WordPress 4.3.31
4.3.9
Fixed in WordPress 4.3.31
4.3.8
Fixed in WordPress 4.3.31
4.3.7
Fixed in WordPress 4.3.31
4.3.6
Fixed in WordPress 4.3.31
4.3.5
Fixed in WordPress 4.3.31
4.3.4
Fixed in WordPress 4.3.31
4.3.3
Fixed in WordPress 4.3.31
4.3.2
Fixed in WordPress 4.3.31
4.3.1
Fixed in WordPress 4.3.31
4.3
Fixed in WordPress 4.3.31
4.2.34
Fixed in WordPress 4.2.35
4.2.33
Fixed in WordPress 4.2.35
4.2.32
Fixed in WordPress 4.2.35
4.2.31
Fixed in WordPress 4.2.35
4.2.30
Fixed in WordPress 4.2.35
4.2.29
Fixed in WordPress 4.2.35
4.2.28
Fixed in WordPress 4.2.35
4.2.27
Fixed in WordPress 4.2.35
4.2.26
Fixed in WordPress 4.2.35
4.2.25
Fixed in WordPress 4.2.35
4.2.24
Fixed in WordPress 4.2.35
4.2.23
Fixed in WordPress 4.2.35
4.2.22
Fixed in WordPress 4.2.35
4.2.21
Fixed in WordPress 4.2.35
4.2.20
Fixed in WordPress 4.2.35
4.2.19
Fixed in WordPress 4.2.35
4.2.18
Fixed in WordPress 4.2.35
4.2.17
Fixed in WordPress 4.2.35
4.2.16
Fixed in WordPress 4.2.35
4.2.15
Fixed in WordPress 4.2.35
4.2.14
Fixed in WordPress 4.2.35
4.2.13
Fixed in WordPress 4.2.35
4.2.12
Fixed in WordPress 4.2.35
4.2.11
Fixed in WordPress 4.2.35
4.2.10
Fixed in WordPress 4.2.35
4.2.9
Fixed in WordPress 4.2.35
4.2.8
Fixed in WordPress 4.2.35
4.2.7
Fixed in WordPress 4.2.35
4.2.6
Fixed in WordPress 4.2.35
4.2.5
Fixed in WordPress 4.2.35
4.2.4
Fixed in WordPress 4.2.35
4.2.3
Fixed in WordPress 4.2.35
4.2.2
Fixed in WordPress 4.2.35
4.2.1
Fixed in WordPress 4.2.35
4.2
Fixed in WordPress 4.2.35
4.1.37
Fixed in WordPress 4.1.38
4.1.36
Fixed in WordPress 4.1.38
4.1.35
Fixed in WordPress 4.1.38
4.1.34
Fixed in WordPress 4.1.38
4.1.33
Fixed in WordPress 4.1.38
4.1.32
Fixed in WordPress 4.1.38
4.1.31
Fixed in WordPress 4.1.38
4.1.30
Fixed in WordPress 4.1.38
4.1.29
Fixed in WordPress 4.1.38
4.1.28
Fixed in WordPress 4.1.38
4.1.27
Fixed in WordPress 4.1.38
4.1.26
Fixed in WordPress 4.1.38
4.1.25
Fixed in WordPress 4.1.38
4.1.24
Fixed in WordPress 4.1.38
4.1.23
Fixed in WordPress 4.1.38
4.1.22
Fixed in WordPress 4.1.38
4.1.21
Fixed in WordPress 4.1.38
4.1.20
Fixed in WordPress 4.1.38
4.1.19
Fixed in WordPress 4.1.38
4.1.18
Fixed in WordPress 4.1.38
4.1.17
Fixed in WordPress 4.1.38
4.1.16
Fixed in WordPress 4.1.38
4.1.15
Fixed in WordPress 4.1.38
4.1.14
Fixed in WordPress 4.1.38
4.1.13
Fixed in WordPress 4.1.38
4.1.12
Fixed in WordPress 4.1.38
4.1.11
Fixed in WordPress 4.1.38
4.1.10
Fixed in WordPress 4.1.38
4.1.9
Fixed in WordPress 4.1.38
4.1.8
Fixed in WordPress 4.1.38
4.1.7
Fixed in WordPress 4.1.38
4.1.6
Fixed in WordPress 4.1.38
4.1.5
Fixed in WordPress 4.1.38
4.1.4
Fixed in WordPress 4.1.38
4.1.3
Fixed in WordPress 4.1.38
4.1.2
Fixed in WordPress 4.1.38
4.1.1
Fixed in WordPress 4.1.38
4.1
Fixed in WordPress 4.1.38
5.7.8
Fixed in WordPress 5.7.9
5.7.7
Fixed in WordPress 5.7.9
5.7.6
Fixed in WordPress 5.7.9
5.7.5
Fixed in WordPress 5.7.9
5.7.4
Fixed in WordPress 5.7.9
5.7.3
Fixed in WordPress 5.7.9
5.7.2
Fixed in WordPress 5.7.9
5.7.1
Fixed in WordPress 5.7.9
5.7
Fixed in WordPress 5.7.9

References

URL
https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
John Blackbourn
Verified
Yes
WPVDB ID
a03d744a-9839-4167-a356-3e7da0f1d532

Timeline

Publicly Published
2023-05-16 (about 11 months ago)
Added
2023-05-17 (about 11 months ago)
Last Updated
2023-05-23 (about 11 months ago)

Other

Published
Title
Published
2023-07-03
Title
Login/Signup Popup < 2.4 - Settings Reset via CSRF
Published
2023-12-28
Title
Floating Button < 6.0.1 - Cross-Site Request Forgery via process_bulk_action
Published
2022-10-27
Title
ProfileGrid < 5.0.4 - Subscriber+ Private Message Read/Edition
Published
2023-03-28
Title
Advanced Shipment Tracking for WooCommerce <= 3.5.2 - CSRF
Published
2014-12-18
Title
Tweetscribe <= 1.1 - Multiple CSRF