Lucene search

WordfenceCVE-2023-2407

HistoryJun 03, 2023 - 5:15 a.m.

CVE-2023-2407

2023-06-0305:15:09

CWE-352

Wordfence

web.nvd.nist.gov

cve-2023-2407

cross-site request forgery

wordpress

plugins

security vulnerability

vcita

online payments

paypal

square

stripe

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.4

Confidence

High

EPSS

0.002

Percentile

51.5%

JSON

The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing nonce validation in the ls_parse_vcita_callback() function. This makes it possible for unauthenticated attackers to modify the plugin’s settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected configurations

Nvd

Vulners

Node

vcitaevent_registration_calendar_by_vcitaRange≤3.9.1wordpress

vcitaonline_payments_-_get_paid_with_paypal\,_square_\&_stripeRange≤1.3.1wordpress

VendorProductVersionCPE
vcitaevent_registration_calendar_by_vcita*cpe:2.3:a:vcita:event_registration_calendar_by_vcita:*:*:*:*:*:wordpress:*:*
vcitaonline_payments_-_get_paid_with_paypal\,_square_\&_stripe*cpe:2.3:a:vcita:online_payments_-_get_paid_with_paypal\,_square_\&_stripe:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
vcita	event_registration_calendar_by_vcita	*	cpe:2.3:a:vcita:event_registration_calendar_by_vcita::::::wordpress::*
vcita	online_payments_-_get_paid_with_paypal\,_square_\&_stripe	*	cpe:2.3:a:vcita:online_payments_-_get_paid_with_paypal\,_square_\&_stripe::::::wordpress::*

CNA Affected

[
  {
    "vendor": "vcita",
    "product": "Event Registration Calendar By vcita",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.3.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "vcita",
    "product": "Online Payments – Get Paid with PayPal, Square & Stripe",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.9.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita

plugins.trac.wordpress.org/browser/event-registration-calendar-by-vcita/trunk/system/parse_vcita_callback.php#L55

plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/trunk/system/parse_vcita_callback.php

www.wordfence.com/threat-intel/vulnerabilities/id/207b40fa-2062-48d6-990b-f05cbbf8fb8e?source=cve

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.4

Confidence

High

EPSS

0.002

Percentile

51.5%

JSON

Related for CVE-2023-2407