VDB
CVE-2018-3810
CVE-2018-3810
PUBLISHED
KEV
CVSS 9.800000190734863 CRITICAL
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.
EPSS 91.14% · 99.8th percentile
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
91.14%
99.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| oturia | smart_google_code_inserter | 0 |
| n/a | n/a | * |
Timeline
- CVE Published
- Jan 3, 2018 PoC Published
- Jan 3, 2018 PoC Published
- Apr 14, 2021 EPSS Score
- Aug 2, 2021 PoC Published
- Mar 7, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jun 15, 2023 EPSS Score
- Aug 21, 2023 EPSS Score
- Nov 27, 2023 VulnCheck KEV Exploitation
- Dec 11, 2023 VulnCheck KEV Exploitation
- Dec 12, 2023 EPSS Score
References
- Nuclei Template exploit
- https://wordpress.org/plugins/smart-google-code-inserter/#developers url
- https://www.exploit-db.com/exploits/43420/ exploit
- https://limbenjamin.com/articles/smart-google-code-inserter-auth-bypass.html exploit
- https://nvd.nist.gov/vuln/detail/CVE-2018-3810 advisory
- https://wpvulndb.com/vulnerabilities/8987 url
- https://www.exploit-db.com/exploits/43420 url