The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/d61d4be7-9251-4c62-8fb7-8a456aa6969e | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/d61d4be7-9251-4c62-8fb7-8a456aa6969e | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 07:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/d61d4be7-9251-4c62-8fb7-8a456aa6969e - Exploit, Third Party Advisory |
31 Oct 2024, 11:45
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Rextheme
Rextheme wp Vr |
|
| CPE | cpe:2.3:a:rextheme:wp_vr:*:*:*:*:*:wordpress:*:* |
03 May 2023, 19:06
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:coderex:wp_vr:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| References | (MISC) https://wpscan.com/vulnerability/d61d4be7-9251-4c62-8fb7-8a456aa6969e - Exploit, Third Party Advisory |
24 Apr 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-24 19:15
Updated : 2025-02-04 16:15
NVD link : CVE-2023-1414
Mitre link : CVE-2023-1414
CVE.ORG link : CVE-2023-1414
JSON object : View
Products Affected
rextheme
- wp_vr