CVE-2019-11591 - The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized

Back Back to CVE browser

HIGH

The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized

Published Apr 29, 2019

8.8

HIGH

CVSS 3.1

EPSS 1.06%

Description

The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-22

Path Traversal

CWE-352

CSRF

CWE-829

References (4)

http://seclists.org/fulldisclosure/2019/Apr/37
x_refsource_MISCExploitMailing ListThird Party Advisory
https://lists.openwall.net/full-disclosure/2019/04/05/12
x_refsource_MISCExploitMailing ListThird Party Advisory
https://wordpress.org/plugins/contact-form-maker/#developers
x_refsource_MISCThird Party Advisory
https://wpvulndb.com/vulnerabilities/9252
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
http://seclists.org/fulldisclosure/2019/Apr/37		x_refsource_MISCExploitMailing ListThird Party Advisory
https://lists.openwall.net/full-disclosure/2019/04/05/12		x_refsource_MISCExploitMailing ListThird Party Advisory
https://wordpress.org/plugins/contact-form-maker/#developers		x_refsource_MISCThird Party Advisory
https://wpvulndb.com/vulnerabilities/9252		x_refsource_MISCThird Party Advisory