Cross site request forgery (csrf)

2018-04-2314:29:00

PRIOn knowledge base

www.prio-n.com

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.4%

JSON

The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin.

CPENameOperatorVersion
user_profile_\\&_membershiplt2.0.7

CPE	Name	Operator	Version
	user_profile_\\&_membership	lt	2.0.7

References

github.com/RiieCco/write-ups/tree/master/CVE-2018-10233

wordpress.org/plugins/ultimate-member/

wpvulndb.com/vulnerabilities/9611