CVE-2023-6824: Authorization Bypass Through User-Controlled Key

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

WordPress plugin WP Customer Area security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

WP Customer Area < 8.2.1 - Subscriber+ Account Address Update

Description The plugin does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address. PoC You may get the nonce from your save address form fetch"https://example.com/wp-admin/admin-ajax.php", "headers": "content-type":...

WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak

Description The plugin does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address. PoC Run the below command in the developer console of the browser when being logged in the blog as a subscriber and on your own edit accou...

WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak

Description The plugin does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address. Run the below command in the developer console of the browser when being logged in the blog as a subscriber and on your own edit account...

WP Customer Area < 8.2.1 - Subscriber+ Account Address Update

Description The plugin does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address. You may get the nonce from your save address form fetch"https://example.com/wp-admin/admin-ajax.php", "headers": "content-type":...

CVE-2022-4745

The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example...

Cross site request forgery (csrf)

The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example...

CVE-2022-4745 WP Customer Area < 8.1.4 - Unauthorised Actions via CSRF

The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example...

CVE-2022-4745 WP Customer Area < 8.1.4 - Unauthorised Actions via CSRF

The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example...

CVE-2022-4745

The CVE-2022-4745 entry describes a CSRF weakness in the WP Customer Area WordPress plugin prior to version 8.1.4. The issue allows a logged-in attacker to trigger actions such as chmod, mkdir, and copy, potentially causing an admin to perform arbitrary folder creation or file copying. Public sou...

WordPress plugin WP Customer Area 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2022-4745: Undefined Security Weakness

The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example...

PT-2023-15326 · WordPress · Wp Customer Area

Name of the Vulnerable Software and Affected Versions: WP Customer Area versions prior to 8.1.4 Description: The issue concerns a lack of CSRF checks for certain actions, such as chmod, mkdir, and copy. This could allow attackers to make a logged-in admin perform these actions, resulting in the...

WordPress WP Customer Area Plugin < 8.1.4 is vulnerable to Remote Code Execution (RCE)

Software WP Customer Area Type Plugin Vulnerable versions 8.1.4 Fixed in 8.1.4 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2022-4745 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID fc8e26b37a92 Credits rezaduty Required privilege...

CVE-2017-18519

The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...

CVE-2017-18519

The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...

CVE-2017-18519

The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...

CVE-2017-18519

The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...

CVE-2017-18519

CVE-2017-18519 affects the WordPress plugin customer-area prior to version 7.4.3, with XSS via admin pages. Root cause: improper sanitization in admin interfaces. Impact: XSS could be triggered from the admin area; remediation: upgrade to 7.4.3 or later.