Description

WordPress Plugin SS Downloads is prone to cross-site request forgery and information disclosure vulnerabilities. An attacker can exploit these issues to perform certain administrative actions and gain unauthorized access to the affected application, or to obtain sensitive information that may help in launching further attacks. WordPress Plugin SS Downloads version 1.4.3 is vulnerable; prior versions may also be affected.

Remediation

Update to the latest version

References

http://1337day.com/exploits/18530

http://packetstormsecurity.com/files/113431/WordPress-SS-Downloads-1.4.3-Cross-Site-Request-Forgery-File-Disclosure.html

Related Vulnerabilities

WordPress Plugin Sliding Social Icons Cross-Site Request Forgery (1.61)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Multiple Vulnerabilities (1.3.88)

jQuery Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-6071)

WordPress Plugin Print, PDF, Email by PrintFriendly Multiple Unspecified Vulnerabilities (3.5.2)

Opencart Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-28838)

Severity

High

Classification

CWE-352 CWE-538 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update CSRF Information Disclosure