Description

WordPress Plugin Total Donations for Wordpress is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently access sensitive data, make unauthorized changes to the site's content and configuration, or take over the vulnerable site. WordPress Plugin Total Donations for Wordpress version 2.0.5 is vulnerable; prior versions may also be affected.

Remediation

DELETE the plugin

References

https://www.wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-vulnerabilities-in-total-donations-plugin/

Related Vulnerabilities

Oracle Database Server CVE-2009-1979 Vulnerability (CVE-2009-1979)

YOURLS Improper Restriction of Rendered UI Layers or Frames Vulnerability (CVE-2021-3734)

WordPress 4.2.x Cross-Domain Flash Injection Vulnerability (4.2 - 4.2.18)

TYPO3 Inadequate Encryption Strength Vulnerability (CVE-2010-3670)

WordPress Plugin Yakadanda Google+ Hangout Events Cross-Site Scripting (0.3.7)

Severity

High

Classification

CVE-2019-6703 CWE-264 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass