WordPress Plugin Vulnerabilities

Multiple Plugins - CSRF Bypass

Description

Multiple plugins are affected by CSRF issues due to a logic flaw in their CSRF checks, which could allow attackers to make users perform unwanted actions

rucy <= 0.4.4
wp-backgrounds-lite <= 2.3
wp-security-questions <= 1.0.5
photo-contest <= 1.0.6
opal-estate <= 1.6.11
rays-grid <= 1.2.2

Affects Plugins

Plugin icon
rucy
No known fix
Plugin icon
wp-backgrounds-lite
No known fix
Plugin icon
wp-security-questions
No known fix
Plugin icon
event-espresso-decaf
Fixed in 4.10.14
Plugin icon
photo-contest
No known fix
Plugin icon
opal-estate
No known fix
Plugin icon
exportfeed-for-woocommerce-product-to-etsy
Fixed in 3.3.2
Plugin icon
rays-grid
Fixed in 1.2.3
Plugin icon
sell-media
Fixed in 2.5.7.3

References

CVE
CVE-2021-4423
CVE
CVE-2021-4420
CVE
CVE-2021-4419
URL
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Jerome Bruandet (nintechnet)
Verified
Yes
WPVDB ID
c1b8952c-d6fb-49e7-9bb3-11d9bf5d1bc0

Timeline

Publicly Published
2021-08-16 (about 2 years ago)
Added
2021-08-16 (about 2 years ago)
Last Updated
2023-07-12 (about 10 months ago)

Other

Published
Title
Published
2024-04-25
Title
Serious Slider <= 1.2.4 - Cross-Site Request Forgery
Published
2023-05-30
Title
NextGen GalleryView <= 0.5.5 - Cross-Site Request Forgery
Published
2023-11-23
Title
MyBookTable Bookstore < 3.3.5 - API Key Update via CSRF
Published
2016-08-15
Title
Email Users <= 4.8.3 - Cross-Site Request Forgery (CSRF)
Published
2014-08-01
Title
WP-DownloadManager 1.60 - Script Insertion CSRF