WordPress Cross Site Request Forgery Vulnerability
BID:71232
Info
WordPress Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 71232 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-9033 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 20 2014 12:00AM |
| Updated: | Apr 16 2015 05:42PM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
WordPress WordPress 3.3.2 WordPress WordPress 3.2.2 WordPress WordPress 3.1.4 WordPress WordPress 3.1.3 WordPress WordPress 3.1.2 WordPress WordPress 3.1.1 WordPress WordPress 3.0.5 WordPress WordPress 3.0.4 WordPress WordPress 3.0.3 WordPress WordPress 3.0.2 WordPress WordPress 2.9.2 WordPress WordPress 2.9.1 WordPress WordPress 2.8.6 WordPress WordPress 2.8.5 WordPress WordPress 2.8.4 WordPress WordPress 2.8.3 WordPress WordPress 2.8.2 WordPress WordPress 2.8.1 WordPress WordPress 2.6.5 WordPress WordPress 2.6.2 WordPress WordPress 2.6.1 WordPress WordPress 2.5.1 WordPress WordPress 2.3.3 WordPress WordPress 2.3.2 WordPress WordPress 2.3.1 WordPress WordPress 2.2.3 WordPress WordPress 2.2.2 WordPress WordPress 2.2.1 WordPress WordPress 2.1.3 WordPress WordPress 2.1.2 WordPress WordPress 2.1.1 WordPress WordPress 2.0.11 WordPress WordPress 2.0.10 WordPress WordPress 2.0.7 WordPress WordPress 2.0.6 WordPress WordPress 2.0.5 WordPress WordPress 2.0.4 WordPress WordPress 2.0.3 WordPress WordPress 2.0.2 WordPress WordPress 2.0.1 WordPress WordPress 2.0 WordPress WordPress 1.5.2 WordPress WordPress 1.5.1 .3 WordPress WordPress 1.5.1 .2 WordPress WordPress 1.5.1 WordPress WordPress 1.5 WordPress WordPress 1.3.1 WordPress WordPress 1.2.2 WordPress WordPress 1.2.1 WordPress WordPress 1.2 WordPress WordPress 3.3.1 WordPress WordPress 3.3 WordPress WordPress 3.2-RC3 WordPress WordPress 3.2-RC1 WordPress WordPress 3.1 WordPress WordPress 3.0.6 WordPress WordPress 3.0.1 WordPress WordPress 2.9.1.1 WordPress WordPress 2.9 WordPress WordPress 2.8.5.2 WordPress WordPress 2.8.5.1 WordPress WordPress 2.8 WordPress WordPress 2.7.1 WordPress WordPress 2.7 WordPress WordPress 2.6.3 WordPress WordPress 2.6 WordPress WordPress 2.5 WordPress WordPress 2.3 WordPress WordPress 2.2 WordPress WordPress 2.1.3-RC2 WordPress WordPress 2.1.3-RC1 WordPress WordPress 2.1 WordPress WordPress 2.0.9 WordPress WordPress 2.0.8 WordPress WordPress 2.0.10-RC2 WordPress WordPress 2.0.10-RC1 WordPress WordPress 1.5.1.1 WordPress WordPress 1.5 WordPress WordPress 1.3.3 WordPress WordPress 1.3.2 WordPress WordPress 1.3 WordPress WordPress 1.2.5 WordPress WordPress 1.2.4 WordPress WordPress 1.2.3 WordPress WordPress 1.1.1 WordPress WordPress 1.0.2 WordPress WordPress 1.0.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: | |
Discussion
WordPress Cross Site Request Forgery Vulnerability
WordPress is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.
WordPress prior to 4.0.1 are vulnerable.
WordPress is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.
WordPress prior to 4.0.1 are vulnerable.
Exploit / POC
WordPress Cross Site Request Forgery Vulnerability
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.
References
WordPress Cross Site Request Forgery Vulnerability
References:
References: