CVE-2014-7957 Cross-site request forgery in n/a
CSRF vulnerabilities in the Pods WordPress plugin allow attackers to hijack administrator sessions to modify settings, delete data, or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2014-7957?
CVE-2014-7957 is a medium-severity vulnerability in n/a, published on 15 Jan 2015. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the toggled parameter in a toggle action in the pods-components page to wp-admin/admin.php, (2) delete a pod in a delete action in the pods page to wp-admin/admin.php, (3) reset pod settings and data via the pods_reset parameter in the pod-settings page to wp-admin/admin.php, (4) deactivate and reset pod data via the pods_reset_deactivate parameter in the pod-settings page to wp-admin/admin.php, (5) delete the admin role via the id parameter in a delete action in the pods-component-roles-and-capabilities page to wp-admin/admin.php, or (6) enable "roles and capabilities" in a toggle action in the pods-components page to wp-admin/admin.php.
Weakness: CWE-352
Which versions are affected by CVE-2014-7957?
It affects 1 product.
Products include Pods Foundation Pods.
How do I fix CVE-2014-7957?
No fix has been published for CVE-2014-7957 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-7957 being exploited?
There is no known exploitation of CVE-2014-7957 in the wild and no public exploit code.
Sources
Also known as GHSA-6gr9-w5xf-xjq3.