Access Control Flaw in Total Donations Plugin by Calmar Webmedia
CVE-2019-6703

9.8CRITICAL

Key Information:

Vendor

Wordpress
Status
Total Donations
Vendor
CVE Published:
27 January 2019

What is CVE-2019-6703?

The Total Donations plugin for WordPress contains an access control issue within the migla_ajax_functions.php file. This vulnerability allows unauthenticated attackers to send requests to wp-admin/admin-ajax.php, triggering the miglaA_update_me action. Consequently, attackers can alter arbitrary WordPress option values, which can lead to unauthorized changes such as enabling user registration and setting new users to the Administrator role. This serious flaw exposes affected sites to the risk of complete takeover by malicious entities.

References

https://www.wordfence.com/blog/2019/01/wordpress-sites-co...
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9208
x_refsource_MISC

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.