Seamless Donations < 5.1.9 - Arbitrary Settings Update via CSRF
CVE-2022-1610

6.5MEDIUM

Key Information:

Vendor

Wordpress
Status
Seamless Donations: A Platform For Global Fundraising And Rebuilding Using Stripe And Paypal
Vendor
CVE Published:
20 June 2022

What is CVE-2022-1610?

The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affected Version(s)

Seamless Donations: A Platform for Global Fundraising and Rebuilding using Stripe and PayPal 5.1.9

References

https://wpscan.com/vulnerability/88014da6-6179-4527-8f67-...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Ruf
.