blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2019-6703

CRITICAL 9.8 CVSS 3.0
Published
January 27, 2019
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

Affected products and versions

  • n/a n/a — Versions not specified
  • calmar-webmedia total_donations — Up to and including 2.0.5

References

  • wpvulndb.com https://wpvulndb.com/vulnerabilities/9208 Third Party Advisory
  • www.wordfence.com https://www.wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-vulnerabilities-in-total-donations-plugin/ Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record