CVE-2019-15867 Hardcoded credentials in n/a
The slick-popup WordPress plugin contains a hardcoded password for a specific account, allowing attackers to gain unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15867?
CVE-2019-15867 is a high-severity vulnerability in n/a, published on 3 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX action.
Weakness: CWE-798
Which versions are affected by CVE-2019-15867?
It affects 1 product.
Products include Omaksolutions Slick-Popup.
How do I fix CVE-2019-15867?
No fix has been published for CVE-2019-15867 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-15867 being exploited?
There is no known exploitation of CVE-2019-15867 in the wild and no public exploit code.
Sources
Also known as GHSA-34g7-g5m3-mfmr.