MainWP (Various extensions) - Cross-Site Request Forgery
Several MainWP extensions for WordPress are vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to invoke functions normally intended for higher-privileged users such as administrators via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Wtyczka WordPress | MainWP Boilerplate Extension | <= 4.1 | 4.1.1 |
| Wtyczka WordPress | MainWP Article Uploader Extension | <= 4.0.2 | 4.0.3 |
| Wtyczka WordPress | MainWP BlogVault Backup Extension | <= 1.3 | 4.1.2 |
| Wtyczka WordPress | MainWP Broken Link Checker | <= 4.0 | brak poprawki |
| Wtyczka WordPress | MainWP Buddy Extension | <= 4.0.1 | 4.0.3 |
| Wtyczka WordPress | MainWP Clone Extension | <= 4.0.2 | 4.0.3 |
| Wtyczka WordPress | MainWP Code Snippets Extension | <= 4.0.2 | 4.0.3 |
| Wtyczka WordPress | MainWP Comments Extension | <= 4.0.6 | 4.0.7 |
| Wtyczka WordPress | MainWP Favorites Extension | <= 4.0.10 | 4.0.11 |
| Wtyczka WordPress | MainWP File Uploader Extension | <= 4.1 | 4.1.1 |
| Wtyczka WordPress | MainWP Google Analytics Extension | <= 4.0.4 | 4.0.5 |
| Wtyczka WordPress | MainWP iThemes Security Extension | <= 4.1.1 | 4.1.2 |
| Wtyczka WordPress | MainWP Maintenance Extension | <= 4.1.1 | 4.1.2 |
| Wtyczka WordPress | MainWP Page Speed Extension | <= 4.0.2 | 4.0.3 |
| Wtyczka WordPress | MainWP Post Dripper Extension | <= 4.0.4 | 4.0.5 |
| Wtyczka WordPress | MainWP Post Plus Extension | <= 4.0.3 | 4.1.1 |
| Wtyczka WordPress | MainWP Rocket Extension | <= 4.0.3 | 4.0.4 |
| Wtyczka WordPress | MainWP WordPress SEO Extension | <= 4.0.1 | 4.0.3 |
| Wtyczka WordPress | MainWP Staging Extension | <= 4.0.3 | 4.0.4 |
| Wtyczka WordPress | MainWP UpdraftPlus Extension | <= 4.0.6 | 4.0.7 |
| Wtyczka WordPress | MainWP Wordfence Extension | <= 4.0.7 | 4.0.8 |
Odnośniki
- Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Słabość (CWE)
CWE-352- Platforma
- WordPress
- Paczka
MainWP Boilerplate Extension, MainWP Article Uploader Extension, MainWP BlogVault Backup Extension- Ujawniono
- 18.01.2023
- Aktualizacja
- 11.10.2026 10:23
Źródła i licencje
Wordfence Intelligence - cb105ff0-5085-4813-81a6-b1f0798d576c - Wordfence Intelligence
Copyright 2012-2026 Defiant Inc.
This record contains material that is subject to copyright
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc. Copyright Defiant, Inc. All rights reserved except as granted below. License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026): Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy. Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Historia podatności: MainWP Boilerplate Extension
Wszystkie opisane podatności tej paczki (Wtyczka WordPress), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 3
- Pierwsza → ostatnia
- 01.2023 01.2023
- Bez poprawki
- 0
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Wysoka 2
- Średnia 1
Ujawnienia w latach
- 2023: 3
- 2024: 0
- 2025: 0
- 2026: 0
-
MainWP (Various extensions) - Cross-Site Request Forgery ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.