CVE-2019-15858 Missing authorization in n/a
Unauthenticated attackers can import options to store XSS payloads, leading to remote code execution in the Woody ad snippets plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-15858?
CVE-2019-15858 is a high-severity missing authorization vulnerability in n/a, published on 3 Sep 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
Weakness: CWE-306
Which versions are affected by CVE-2019-15858?
It affects 1 product.
Products include Webcraftic Woody Ad Snippets.
How do I fix CVE-2019-15858?
No fix has been published for CVE-2019-15858 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-15858 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-15858 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-q88p-g94x-r7pc.