Description
WordPress is prone to a security bypass weakness because of a design error in the implementation of anti-CSRF token security feature. An attacker may exploit this issue to bypass anti-CSRF token security protections and perform cross-site request forgery attacks to perform unauthorized actions in the context of a victim's session. This may aid in other attacks. Successful exploitation requires that the attacker must know the anti-CSRF token of the victim within 12 hours by means of other attacks. WordPress version 3.3.1 is vulnerable; other versions may also be affected.
Remediation
Update to WordPress latest version
References
http://www.exploit-db.com/exploits/18791/
http://packetstormsecurity.org/files/112253/WordPress-3.3.1-Cross-Site-Request-Forgery.html
Related Vulnerabilities
SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2026-66808)
SharePoint Heap-based Buffer Overflow Vulnerability (CVE-2026-45475)
Apache Traffic Server Improper Input Validation Vulnerability (CVE-2022-25763)
Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-3464)
Joomla Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-35615)