6.5
CVE-2021-24989
- EPSS 0.54%
- Veröffentlicht 24.01.2022 08:15:09
- Zuletzt bearbeitet 21.11.2024 05:54:08
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginAccept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRF
Accept Donations with PayPal <= 1.3.3 - Arbitrary Post Deletion via Cross-Site Request Forgery
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog
Mögliche Gegenmaßnahme
Accept Donations with PayPal & Stripe: Update to version 1.3.4, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wpplugin ≫ Accept Donations With Paypal SwPlatformwordpress Version < 1.3.4
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Accept Donations with PayPal & Stripe
Version
*-1.3.3
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.54% | 0.41 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
https://wpscan.com/vulnerability/82c2ead1-1d3c-442a-ae68-359a4748447f
https://www.wordfence.com/threat-intel/vulnerabilities/id/641e52d1-d046-4c15-9624-3b1919cd674f