CVE-2020-6167 Cross-site request forgery in n/a
A CSRF vulnerability in the Minimal Coming Soon & Maintenance Mode WordPress plugin allows attackers to modify settings, inject XSS, or enable maintenance mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-6167?
CVE-2020-6167 is a critical vulnerability in n/a, published on 9 Jan 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo.
Weakness: CWE-352
Which versions are affected by CVE-2020-6167?
It affects 1 product.
Products include Webfactoryltd Minimal Coming Soon \& Maintenance Mode.
How do I fix CVE-2020-6167?
No fix has been published for CVE-2020-6167 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-6167 being exploited?
There is no known exploitation of CVE-2020-6167 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-6168 Missing authorization in n/a
- CVE-2024-5087 Minimal Coming Soon – Coming Soon Page <= 2.38 - Missing Authorization to Limited Settings Change
- CVE-2020-6166 Missing authorization in n/a
- CVE-2024-1075 Minimal Coming Soon – Coming Soon Page <= 2.37 - Unauthenticated Maintenance Mode Bypass
Sources
Also known as GHSA-h3f7-j353-jjmr.