Vulnerability Description
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Calmar-Webmedia | Total Donations | <= 2.0.5 |
References
- https://wpvulndb.com/vulnerabilities/9208Third Party Advisory
- https://www.wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-ExploitThird Party Advisory
- https://wpvulndb.com/vulnerabilities/9208Third Party Advisory
- https://www.wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-ExploitThird Party Advisory
FAQ
What is CVE-2019-6703?
CVE-2019-6703 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option val...
How severe is CVE-2019-6703?
CVE-2019-6703 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-6703?
Check the references section above for vendor advisories and patch information. Affected products include: Calmar-Webmedia Total Donations.