Cross-Site Request Forgery in Icegram Plugin for WordPress
CVE-2016-10962

6.5MEDIUM

Key Information:

Vendor

Wordpress
Status
Icegram Engage
Vendor
CVE Published:
16 September 2019

What is CVE-2016-10962?

The Icegram plugin for WordPress, prior to version 1.9.19, is susceptible to a Cross-Site Request Forgery (CSRF) attack. The vulnerability arises through improper handling of the 'option_name' parameter in the wp-admin/edit.php script, which could allow an attacker to trick an authenticated user into executing unwanted actions on the site. This can lead to unauthorized changes and compromises the integrity of the WordPress installation.

References

https://wordpress.org/plugins/icegram/#developers
x_refsource_MISC
https://sumofpwn.nl/advisory/2016/cross_site_request_forg...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.