Cross-Site Request Forgery Vulnerability in Acurax Social Media Widget by WordPress
CVE-2018-6357

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Social Media Widget
Vendor
CVE Published:
3 October 2022

Summary

The Acurax Social Media Widget, specifically the acx_asmw_saveorder_callback function in its function.php file, is susceptible to Cross-Site Request Forgery (CSRF) attacks in versions prior to 3.2.6. This vulnerability allows an attacker to exploit the recordsArray parameter while making requests to wp-admin/admin-ajax.php, potentially leading to unauthorized actions. Consequently, this can be leveraged to execute an XSS attack, compromising user data and site integrity.

References

http://lists.openwall.net/full-disclosure/2018/01/10/8
x_refsource_MISC
https://wordpress.org/plugins/acurax-social-media-widget/...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.