Unscored severity · published Mar 22, 2013
CVE-2013-2640
ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin…
–
CVSS
2.4%
EPSS
No
On KEV
Description
ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to "formData=save" requests, a different version than CVE-2013-0731.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
Wp-mailup · Mailup
through 1.3.1; 1.0.0; 1.1.0; 1.1.1; 1.1.2; 1.1.3; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2640
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2640
osvdb.org
http://osvdb.org/91274
Exploit
http://plugins.trac.wordpress.org/changeset?new=682420
Vendor Advisory
http://secunia.com/advisories/51917
wordpress.org
http://wordpress.org/extend/plugins/wp-mailup/changelog/
More from Wp-mailup
–
CVE-2013-0731
ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin…