CVE-2019-6703

🗓️ 27 Jan 2019 02:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 85 Views🌐 WEB

Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. Attackers can send requests to wp-admin/admin-ajax.php to change arbitrary options on affected sites, enabling new user registration and setting the default role for new users to Administrator

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2019-6703	29 Jan 201916:52	–	circl
Cvelist	CVE-2019-6703	27 Jan 201902:00	–	cvelist
EUVD	EUVD-2019-16261	7 Oct 202500:30	–	euvd
Nuclei	Total Donations Plugin for WordPress < 2.0.6 - Arbitrary Options Update	16 Oct 202602:05	–	nuclei
NVD	CVE-2019-6703	27 Jan 201902:29	–	nvd
osv_cve	CVE-2019-6703	27 Jan 201902:29	–	osv_cve
Prion	Improper access control	27 Jan 201902:29	–	prion
Positive Technologies	PT-2019-18275	27 Jan 201900:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2019-6703: Undefined Security Weakness	27 Jan 201900:00	–	rapid7
ThreatPost	Wordpress Users Urged to Delete Zero-Day-Ridden Plugin	28 Jan 201914:39	–	threatpost

NVD

Node

calmar-webmedia total_donationsRange≤2.0.5wordpress

Source	Link
wordfence	www.wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-vulnerabilities-in-total-donations-plugin/
wpvulndb	www.wpvulndb.com/vulnerabilities/9208

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	CVE-2019-6703: Incorrect access control in migla_ajax_functions.php of the Calmar Webmedia Total Donations plugin allows unauthenticated attackers to call the miglaA_update_me action via wp-admin/admin-ajax.php to change arbitrary WordPress options, enabling site takeover.

17 Jun 2026 02:39Current

9.4Critical risk

Vulners AI Score9.4

CVSS 27.5

CVSS 39.8

EPSS0.26076

In Wild