Description

WordPress Plugin Google Adsense and Hotel Booking is prone to an open proxy vulnerability. Exploiting this issue may allow attackers to hide attacks on third parties, or DoS a site if the POST request is pointed back at itself causing a loop. WordPress Plugin Google Adsense and Hotel Booking version 1.0.5 is vulnerable; prior versions are also affected.

Remediation

Disable the plugin until a fix is available

References

http://www.vapidlabs.com/advisory.php?v=151

Related Vulnerabilities

WordPress Plugin UsersWP-Front-end login form, User Registration, User Profile & Members Directory for WP SQL Injection (1.2.10)

WordPress Plugin WP GPX Maps 'wp-gpx-maps_admin_tracks.php' Arbitrary File Upload (1.1.22)

WordPress Plugin Dtracker Multiple Vulnerabilities (1.5)

Apache 2.x version equal to 2.0.51

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Cross-Site Scripting (2.7.0)

Severity

High

Classification

CVE-2015-1000009 CWE-441 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update