Cross-Site Request Forgery in WP ERP Plugin for WordPress
CVE-2020-36735
4.3MEDIUM
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 1 July 2023
Summary
The WP ERP plugin, which offers comprehensive HR and recruitment solutions for WordPress sites, contains a vulnerability that arises from inadequate nonce validation. This issue affects versions up to and including 1.6.3, allowing attackers to exploit functions such as handle_leave_calendar_filter, add_enable_disable_option_save, leave_policies, process_bulk_action, and process_crm_contact. An attacker can craft a malicious link that, when clicked by an unsuspecting site administrator, could lead to unauthorized changes to plugin settings, compromising the integrity of the WordPress site.
Affected Version(s)
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting * < 1.6.4
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Jerome Bruandet