Unscored severity · published Mar 22, 2013
CVE-2013-0731
ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin…
–
CVSS
2.6%
EPSS
No
On KEV
Description
ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie. NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
Wp-mailup · Mailup
through 1.3.2; 1.0.0; 1.1.0; 1.1.1; 1.1.2; 1.1.3; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0731
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0731
osvdb.org
http://osvdb.org/91274
Exploit
http://plugins.trac.wordpress.org/changeset?new=682420
Vendor Advisory
http://secunia.com/advisories/51917
wordpress.org
http://wordpress.org/extend/plugins/wp-mailup/changelog/
www.securityfocus.com
http://www.securityfocus.com/bid/58467
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/82847
More from Wp-mailup
–
CVE-2013-2640
ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin…