Medium severity · published May 10, 2017
CVE-2017-8875
CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Clean Login · Codection
1.7.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-8875
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-8875
Exploit
http://seclists.org/fulldisclosure/2017/May/23
Release Notes
https://wordpress.org/plugins/clean-login/#developers
More from Clean Login
8.8
CVE-2024-8252
Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion
6.1
CVE-2015-9336
The clean-login plugin before 1.5.1 for WordPress has reflected XSS
5.4
CVE-2022-4838
The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with…