8.8
CVE-2023-47870
- EPSS 0.27%
- Veröffentlicht 30.11.2023 18:15:07
- Zuletzt bearbeitet 28.04.2026 19:22:06
- Quelle audit@patchstack.com
- CVE-Watchlists
- Unerledigt
LoginWordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)
wpForo Forum <= 2.2.8 - Cross-Site Request Forgery via logout()
Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6.
Mögliche Gegenmaßnahme
wpForo Forum: Update to version 2.2.9, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gvectors ≫ Wpforo Forum SwPlatformwordpress Version <= 2.2.6
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
wpForo Forum
Version
*-2.2.8
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.27% | 0.18 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| audit@patchstack.com | 5.7 | 2.1 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-plugin-2-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
https://www.wordfence.com/threat-intel/vulnerabilities/id/3bce40ee-c378-4a44-9c5d-d83151975309