CVE

Id
60678  
CVE No.
CVE-2013-0731  
Status
Candidate  
Description
ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie. NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2.  
Phase
Assigned (20130102)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
611030 60678 CVE-2013-0731 MISC:http://plugins.trac.wordpress.org/changeset?new=682420  View
611031 60678 CVE-2013-0731 CONFIRM:http://wordpress.org/extend/plugins/wp-mailup/changelog/  View
611032 60678 CVE-2013-0731 BID:58467  View
611033 60678 CVE-2013-0731 URL:http://www.securityfocus.com/bid/58467  View
611034 60678 CVE-2013-0731 OSVDB:91274  View
611035 60678 CVE-2013-0731 URL:http://osvdb.org/91274  View
611036 60678 CVE-2013-0731 SECUNIA:51917  View
611037 60678 CVE-2013-0731 URL:http://secunia.com/advisories/51917  View
611038 60678 CVE-2013-0731 XF:mailup-ajaxfunctions-security-bypass(82847)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
23001 JVNDB-2013-004576 WordPress 用 Mingle Forum プラグインにおけるクロスサイトリクエストフォージェリの脆弱性 WordPress 用 Mingle Forum プラグインには、クロスサイトリクエストフォージェリの脆弱性が存在します。 CVE-2013-0736 60678 6.8 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-004576.html  View