CVE-2014-9340

CVE-2014-9340 affects the WordPress wpCommentTwit plugin (versions ≤ 0.5). It describes CSRF combined with XSS that allows an attacker to hijack an administrator’s session by abusing the username/password parameters in wpCommentTwit.php to access wp-admin/options-general.php. Exploitation details...