WordPress CVEs

Description

The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF.

Affected WordPress components

• Site Offline Or Coming Soon Or Maintenance Mode Plugin · site-offline
  Confirmed match Abandoned
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• freehtmldesigns site_offline — Before 1.4.4

References

• advisory.checkmarx.net https://advisory.checkmarx.net/advisory/CX-2020-4292 Exploit, Third Party Advisory
• developer.wordpress.org https://developer.wordpress.org/reference/functions/wp_create_nonce/ Third Party Advisory
• developer.wordpress.org https://developer.wordpress.org/reference/functions/wp_verify_nonce/ Third Party Advisory
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2445009/ Patch, Third Party Advisory
• wordpress.org https://wordpress.org/plugins/site-offline/#developers Product, Third Party Advisory
• nvd.nist.gov Official NVD record