Description

Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.

Remediation

References

CVE-2008-0198

Related Vulnerabilities

Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-3376)

SugarCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14974)

Apache HTTP Server Use After Free Vulnerability (CVE-2019-0196)

Jenkins Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2018-1000406)

WordPress Plugin WP Taxonomy Import Cross-Site Scripting (1.0.4)

Severity

Medium

Classification

CVE-2008-0198 CWE-352

Tags

Missing Update Known Vulnerabilities