Vulnerability Description
Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the iframe_url parameter in an Update Page action in the conformconf page to wp-admin/options-general.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Everybit | Encrypted Contact Form | < 1.1 |
Related Weaknesses (CWE)
References
- http://marc.info/?l=bugtraq&m=142607790919348&w=2Third Party Advisory
- http://packetstormsecurity.com/files/132209/WordPress-Encrypted-Contact-Form-1.0Third Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2015/May/63ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/535699/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/73433Third Party AdvisoryVDB Entry
- https://plugins.trac.wordpress.org/changeset/1125443/Release Notes
- https://wordpress.org/plugins/encrypted-contact-form/changelog/PatchThird Party Advisory
- https://wpvulndb.com/vulnerabilities/7992Third Party Advisory
- https://www.exploit-db.com/exploits/37264/ExploitThird Party AdvisoryVDB Entry
- http://marc.info/?l=bugtraq&m=142607790919348&w=2Third Party Advisory
- http://packetstormsecurity.com/files/132209/WordPress-Encrypted-Contact-Form-1.0Third Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2015/May/63ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/535699/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/73433Third Party AdvisoryVDB Entry
- https://plugins.trac.wordpress.org/changeset/1125443/Release Notes
FAQ
What is CVE-2015-4010?
CVE-2015-4010 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that c...
How severe is CVE-2015-4010?
CVE-2015-4010 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-4010?
Check the references section above for vendor advisories and patch information. Affected products include: Everybit Encrypted Contact Form.