CVE-2017-12651 Cross-site request forgery in n/a
Attackers can perform unauthorized actions via CSRF in the Loginizer plugin's IP wizard due to missing Referer checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-12651?
CVE-2017-12651 is a high-severity vulnerability in n/a, published on 7 Aug 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked.
Weakness: CWE-352
Which versions are affected by CVE-2017-12651?
It affects 1 product.
Products include Loginizer Loginizer.
How do I fix CVE-2017-12651?
No fix has been published for CVE-2017-12651 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-12651 being exploited?
There is no known exploitation of CVE-2017-12651 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-27615 SQL injection in n/a
- CVE-2017-12650 SQL injection in n/a
- CVE-2024-10097 Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2022-45084 WordPress Loginizer Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-2296 Loginizer 1.7.8 - Reflected XSS
Sources
Also known as GHSA-f6j4-5g5c-q29c.