WordPress JW Player for Flash & HTML5 Video Plugin Cross Site Request Forgery Vulnerability

Bugtraq ID:	67954
Class:	Design Error
CVE:	CVE-2014-4030
Remote:	Yes
Local:	No
Published:	Jun 10 2014 12:00AM
Updated:	Jun 25 2014 09:54AM
Credit:	Tom Adams
Vulnerable:
Not Vulnerable:

WordPress JW Player for Flash & HTML5 Video Plugin Cross Site Request Forgery Vulnerability

JW Player for Flash & HTML5 Video is a Plugin for WordPress is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.

JW Player for Flash & HTML5 Video 2.1.3 is vulnerable; other versions may also be affected.

WordPress JW Player for Flash & HTML5 Video Plugin Cross Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

The following example URI is available:

http://www.example.com/wp-admin/admin.php?page=jwp6_menu&player_id=1&action=delete

WordPress JW Player for Flash & HTML5 Video Plugin Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

WordPress JW Player for Flash & HTML5 Video Plugin Cross Site Request Forgery Vulnerability

References: