WordPress Encrypted Contact Form Plugin Multiple Security Vulnerabilities
BID:73433
Info
WordPress Encrypted Contact Form Plugin Multiple Security Vulnerabilities
| Bugtraq ID: | 73433 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-4010 |
| Remote: | Yes |
| Local: | No |
| Published: | May 15 2015 12:00AM |
| Updated: | Jul 15 2015 12:25AM |
| Credit: | Nitin Venkatesh |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
WordPress Encrypted Contact Form Plugin Multiple Security Vulnerabilities
The Encrypted Contact Form plugin for WordPress is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability.
An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions. Other attacks may also be possible.
Versions prior to Encrypted Contact Form 1.1 are vulnerable.
The Encrypted Contact Form plugin for WordPress is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability.
An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions. Other attacks may also be possible.
Versions prior to Encrypted Contact Form 1.1 are vulnerable.
Exploit / POC
WordPress Encrypted Contact Form Plugin Multiple Security Vulnerabilities
An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.
An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.
Solution / Fix
WordPress Encrypted Contact Form Plugin Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
WordPress Encrypted Contact Form Plugin Multiple Security Vulnerabilities
References:
References: