Cross-Site Request Forgery Vulnerability in Tooltipy for WordPress by DXW
CVE-2018-1000505

6.5MEDIUM

Key Information:

Vendor
WordPress
Status
Tooltipy
Vendor
CVE Published:
26 June 2018

Summary

Tooltipy for WordPress, specifically version 5, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability located in its Settings page. An attacker could exploit this flaw to allow unauthorized users to duplicate posts, given that an admin is tricked into following a malicious link. The vulnerability was addressed in version 5.1, highlighting the importance of updating plugins to ensure ongoing site security.

References

https://advisories.dxw.com/advisories/csrf-in-tooltipy/
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.