WordPress Newsletter Manager Plugin Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	65148
Class:	Input Validation Error
CVE:	CVE-2012-6629
Remote:	Yes
Local:	No
Published:	May 15 2012 12:00AM
Updated:	May 15 2012 12:00AM
Credit:	Heine Pedersen and Torben Jensen
Vulnerable:	WordPress Newsletter Manager plugin 1.0.2 WordPress Newsletter Manager plugin 1.0.1 WordPress Newsletter Manager plugin 1.0
Not Vulnerable:

WordPress Newsletter Manager Plugin Multiple Cross Site Request Forgery Vulnerabilities

Newsletter Manager plugin for WordPress is prone to multiple cross-site request-forgery vulnerabilities.

An attacker can exploit these issues to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Newsletter Manager 1.0.2 and prior are vulnerable.

WordPress Newsletter Manager Plugin Multiple Cross Site Request Forgery Vulnerabilities

To exploit these issues an attacker must entice an unsuspecting victim to open a malicious URI.

WordPress Newsletter Manager Plugin Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WordPress Newsletter Manager Plugin Multiple Cross Site Request Forgery Vulnerabilities

References:

• Newsletter Manager Plugin (Wordpress)