Wordfence Security Plugin for WordPress Vulnerabilities

vendor:

Wordfence Security Plugin

by:

SecurityFocus

7,5

CVSS

HIGH

Multiple HTML-Injection and Security Bypass vulnerabilities

79, 287

CWE

Product Name: Wordfence Security Plugin

Affected Version From: Wordfence Security Plugin 5.2.3

Affected Version To: Other versions may also be affected

Patch Exists: Yes

Related CWE: N/A

CPE: a:wordfence:wordfence_security_plugin

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WordPress

2014

Wordfence Security Plugin for WordPress Vulnerabilities

Successful exploits of these issues allow the attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user, or to bypass security mechanisms.

Mitigation:

Update to the latest version of Wordfence Security Plugin

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/69815/info

The Wordfence Security Plugin for WordPress is prone to following vulnerabilities:

1. Multiple HTML-Injection vulnerabilities
2. Multiple Security Bypass vulnerabilities

Successful exploits of these issues allow the attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user, or to bypass security mechanisms.

Wordfence Security Plugin 5.2.3 is vulnerable; other versions may also be affected 

http://www.example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php