Follow @discotekdotca
CVE-2019-16271
Current Description
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
Basic Data
| Published | August 30, 2019 |
|---|---|
| Last Modified | September 05, 2019 |
| Assigner | cve@mitre.org |
| Data Type | CVE |
| Data Format | MITRE |
| Data Version | 4.0 |
| Problem Type | CWE-254 |
| CVE Data Version | 4.0 |
Base Metric V2
| CVSS 2 - Version | 2.0 |
|---|---|
| CVSS 2 - Vector String | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| CVSS 2 - Access Vector | NETWORK |
| CVSS 2 - Access Complexity | LOW |
| CVSS 2 - Authentication | NONE |
| CVSS 2 - Confidentiality Impact | NONE |
| CVSS 2 - Availability Impact | NONE |
| CVSS 2 - Base Score | 5.0 |
| Severity | MEDIUM |
| Exploitability Score | 10.0 |
| Impact Score | 2.9 |
| Obtain All Privilege | false |
| Obtain User Privilege | false |
| Obtain Other Privilege | false |
Base Metric V3
| CVSS 3 - Version | 3.0 |
|---|---|
| CVSS 3 - Vector String | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CVSS 3 - Attack Vector | NETWORK |
| CVSS 3 - Attack Complexity | LOW |
| CVSS 3 - Privileges Required | NONE |
| CVSS 3 - User Interaction | NONE |
| CVSS 3 - Scope | UNCHANGED |
| CVSS 3 - Confidentiality Impact | NONE |
| CVSS 3 - Integrity Impact | HIGH |
| CVSS 3 - Availability Impact | NONE |
| CVSS 3 - Base Score | 7.5 |
| CVSS 3 - Base Severity | HIGH |
| Exploitability Score | 3.9 |
| Base Severity | HIGH |
Configurations
-
OR - Configuration 1
Cpe Version Part Vendor Product Version Update Edition Language SW Edition Target SW Target HW Other Version Start Including Version End Including Version Start Excluding Version End Excluding 2.3 Application Wpexpertdeveloper Wp Private Content Plus * * * * * CVE-2007-2834 * * 2.0
Vulnerable Software List
| Vendor | Product | Versions |
|---|---|---|
| Wpexpertdeveloper | Wp Private Content Plus | * |
References
| Name | Source | URL | Tags |
|---|---|---|---|
| https://blog.nintechnet.com/unauthenticated-options-change-vulnerability-in-wordpress-wp-private-content-plus-plugin/ | https://blog.nintechnet.com/unauthenticated-options-change-vulnerability-in-wordpress-wp-private-con | MISC | Exploit Third Party Advisory |
| https://wordpress.org/plugins/wp-private-content-plus/#developers | https://wordpress.org/plugins/wp-private-content-plus/#developers | MISC | CVE-2005-0856 Third Party Advisory |
| https://wpvulndb.com/vulnerabilities/9817 | https://wpvulndb.com/vulnerabilities/9817 | MISC | Third Party Advisory |