Code injection

2019-08-2912:15:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.2%

The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.

CPENameOperatorVersion
travel_managementlt1.7

CPE	Name	Operator	Version
	travel_management	lt	1.7

References

threatpost.com/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn/147671/

wordpress.org/plugins/nd-travel/

wpvulndb.com/vulnerabilities/9491