PT-2015-5898
CVE-2015-2792
·
Published
2015-03-30
·
Updated
2015-03-31
Description by
CVSS 2.0
7.5
HighMetricsAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
WPML plugin versions prior to 3.1.9
Description
The issue allows remote attackers to bypass nonce checks and perform arbitrary actions. This is achieved by sending a request that contains an action POST parameter, an action GET parameter, and a valid nonce for the action GET parameter.
Recommendations
For WPML plugin versions prior to 3.1.9, update to version 3.1.9 or later to resolve the issue.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾