Unscored severity · published Mar 7, 2015
CVE-2015-0895
Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
All IN One Wordpress Security And Firewall · Tips And Tricks HQ
through 3.8.9 · source: NVD
Affected product
AI
All IN One Wordpress Security And Firewall
Tips And Tricks HQ
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0895
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0895
Vendor Advisory
http://jvn.jp/en/jp/JVN87204433/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000038
Patch
https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/
More from All IN One Wordpress Security And Firewall
7.5
CVE-2024-33591
WordPress Easy Accept Payments for PayPal plugin <= 4.9.10 - Broken Access Control vulnerability
–
CVE-2015-0894
SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified…
–
CVE-2014-6242
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL…