Description

In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.

Remediation

References

CVE-2017-9064

Related Vulnerabilities

WordPress Plugin Rife Elementor Extensions & Templates Multiple Cross-Site Scripting Vulnerabilities (1.1.5)

D3.js Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-16044)

WordPress Plugin Pctags-Pinterest conversion tags for Pinterest Ads (advertising) + Event tracking + Site verification + WooCommerce Security Bypass (1.0.1)

WordPress Plugin SpeakOut! Email Petitions Cross-Site Scripting (2.13.2)

WordPress Plugin My Calendar Cross-Site Scripting (2.4.18)

Severity

High

Classification

CVE-2017-9064 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities