KLA10481 Multiple vulnerabilities in WordPress SEO plugin

2015-03-1700:00:00

Kaspersky Lab

threats.kaspersky.com

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

78.1%

JSON

Multiple CSRF and SQL injection vulnerabilities were found in WordPress SEO plugin. These vulnerabilities can be exploited remotely via vectors related to wpseo_bulk-editor page.

Original advisories

Plugin changelog

Exploitation

Public exploits exist for this vulnerability.

Related products

Wordpress-SEO-plugin

CVE list

CVE-2015-2293 high

CVE-2015-2292 high

Solution

Update to latest version!

Get WordPress SEO plugin

Impacts

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

Wordpress SEO plugin versions earlier than 1.5.7Wordpress SEO plugin 1.6 versions earlier than 1.6.4Wordpress SEO plugin 1.7 versions earlier than 1.7.4