Vulnerability Description
Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) plugin before 3.2.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the custom_style_afo parameter on the login_widget_afo page to wp-admin/options-general.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Login Widget With Shortcode Project | Login Widget With Shortcode | <= 3.1.1 |
Related Weaknesses (CWE)
References
- http://osvdb.org/show/osvdb/111700
- http://osvdb.org/show/osvdb/111757
- http://seclists.org/fulldisclosure/2014/Sep/58Exploit
- http://www.exploit-db.com/exploits/34762Exploit
- https://security.dxw.com/advisories/csrfxss-vulnerablity-in-login-widget-with-shExploit
- https://wordpress.org/plugins/login-sidebar-widget/changelog
- http://osvdb.org/show/osvdb/111700
- http://osvdb.org/show/osvdb/111757
- http://seclists.org/fulldisclosure/2014/Sep/58Exploit
- http://www.exploit-db.com/exploits/34762Exploit
- https://security.dxw.com/advisories/csrfxss-vulnerablity-in-login-widget-with-shExploit
- https://wordpress.org/plugins/login-sidebar-widget/changelog
FAQ
What is CVE-2014-6312?
CVE-2014-6312 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) plugin before 3.2.1 for WordPress allows remote attackers to hijack the authentication of admi...
How severe is CVE-2014-6312?
CVE-2014-6312 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-6312?
Check the references section above for vendor advisories and patch information. Affected products include: Login Widget With Shortcode Project Login Widget With Shortcode.