WordPress Knews Multilingual Newsletters Plugin Cross Site Request Forgery Vulnerability

Bugtraq ID:	56926
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 13 2012 12:00AM
Updated:	Dec 13 2012 12:00AM
Credit:	Reported by vendor
Vulnerable:
Not Vulnerable:

WordPress Knews Multilingual Newsletters Plugin Cross Site Request Forgery Vulnerability

The Knews Multilingual Newsletters plugin for WordPress is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.

Versions prior to Knews Multilingual Newsletters 1.2.6 are vulnerable.

WordPress Knews Multilingual Newsletters Plugin Cross Site Request Forgery Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

WordPress Knews Multilingual Newsletters Plugin Cross Site Request Forgery Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

WordPress Knews Multilingual Newsletters Plugin Cross Site Request Forgery Vulnerability

References:

• WordPress Plugin Homepage (WordPress)