WordPress CVEs

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to wp-admin/options-general.php.

Affected WordPress components

• twitget Plugin · twitget
  Confirmed match Homeless
  Versions not specified; Up to and including 3.3.1
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• twitget_project twitget — Up to and including 3.3.1

References

• packetstormsecurity.com http://packetstormsecurity.com/files/126134 Exploit
• seclists.org http://seclists.org/fulldisclosure/2014/Apr/172 Exploit
• secunia.com http://secunia.com/advisories/57892
• wordpress.org http://wordpress.org/plugins/twitget/changelog Vendor Advisory
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/92391
• security.dxw.com https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1 Exploit
• nvd.nist.gov Official NVD record