Unauthenticated Options Manipulation in Ocean Extra Plugin for WordPress
CVE-2019-16250

7.5HIGH

Key Information:

Vendor

Wordpress
Status
Ocean Extra
Vendor
CVE Published:
11 September 2019

What is CVE-2019-16250?

The Ocean Extra plugin for WordPress, specifically the includes/wizard/wizard.php file, is susceptible to a vulnerability that allows unauthenticated individuals to alter options and inject Cascading Style Sheets (CSS) token sequences. This loophole can be exploited to manipulate site settings without proper authentication, potentially leading to unauthorized alterations in website appearance and functionality.

References

https://blog.nintechnet.com/settings-change-and-css-injec...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.