Cross-Site Request Forgery Vulnerability in Subscribe To Comments Reloaded Plugin for WordPress
CVE-2014-2274

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Subscribe To Comments Reloaded
Vendor
CVE Published:
19 March 2018

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Subscribe To Comments Reloaded plugin prior to version 140219 for WordPress. This flaw enables remote attackers to exploit the authentication of administrators, allowing them to send unauthorized requests that can lead to Cross-Site Scripting (XSS) attacks. By targeting the subscribe-to-comments-reloaded/options/index.php endpoint on the wp-admin/admin.php page, malicious actors can compromise the integrity of a WordPress site and execute harmful scripts.

References

https://wordpress.org/plugins/subscribe-to-comments-reloa...
x_refsource_CONFIRM
https://security.dxw.com/advisories/stored-xss-and-csrf-v...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.