Calmar Webmedia Total Donations Plugin up to 2.0.5 on WordPress Access Control migla_ajax_functions.php Request access control

Summaryinfo

A vulnerability classified as critical has been found in Calmar Webmedia Total Donations Plugin up to 2.0.5 on WordPress. The impacted element is an unknown function of the file migla_ajax_functions.php of the component Access Control. Performing a manipulation as part of Request results in access control. This vulnerability is cataloged as CVE-2019-6703. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Calmar Webmedia Total Donations Plugin up to 2.0.5 on WordPress (WordPress Plugin). This affects some unknown processing of the file migla_ajax_functions.php of the component Access Control. The manipulation as part of a Request leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

The bug was discovered 01/25/2019. The weakness was shared 01/27/2019 (Website). The advisory is shared at wordfence.com. This vulnerability is uniquely identified as CVE-2019-6703 since 01/23/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:migla_ajax_functions.php it is possible to find vulnerable targets with Google Hacking. The commercial vulnerability scanner Qualys is able to test this issue with plugin 13414 (WordPress Total Donations Plugin Privilege Escalation Vulnerability).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• WordPress Plugin

Name

• Calmar Webmedia Total Donations Plugin

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion