WordPress CVEs

Description

Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.

Affected WordPress components

• Portfolio Plugin Plugin · portfolio-by-lisa-westlund
  Confirmed match Abandoned
  Versions not specified
  View on WordPress.org
• Portfolio by BestWebSoft – Work and Projects Presentation Plugin for WordPress Plugin · portfolio
  Possible match Abandoned
  Up to and including 1.0
  View on WordPress.org
• portfolio Theme · portfolio
  Possible match Homeless
  Up to and including 1.0
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• portfolio_project portfolio — Up to and including 1.0

References

• seclists.org http://seclists.org/fulldisclosure/2015/Jul/104 Exploit
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/1175403/portfolio-by-lisa-westlund
• wpvulndb.com https://wpvulndb.com/vulnerabilities/8108
• nvd.nist.gov Official NVD record