VDB
CVE-2023-2526
CVE-2023-2526
PUBLISHED
CVSS 5.400000095367432 MEDIUM
The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to executes AJAX actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-31269 appears to be a duplicate of this issue.
EPSS 0.28% · 20.9th percentile
Risk Scores
CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
EPSS Score
0.28%
20.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| supsystic | easy_google_maps | 0, 0 |
| supsysticcom | Easy Google Maps | 0, * |
Timeline
- Jun 9, 2023 EPSS Score
- Jun 9, 2023 CVE Published
- Jul 15, 2023 EPSS Score
- Aug 20, 2023 EPSS Score
- Sep 25, 2023 EPSS Score
- Dec 6, 2023 EPSS Score
- Jan 11, 2024 EPSS Score
- Feb 16, 2024 EPSS Score
- Mar 23, 2024 EPSS Score
- Apr 28, 2024 EPSS Score
- Jun 3, 2024 EPSS Score
- Jul 9, 2024 EPSS Score
References
- https://plugins.trac.wordpress.org/browser/google-maps-easy/trunk/classes/frame.php?rev=2777743#L246 url
- https://plugins.trac.wordpress.org/changeset/2916430 url
- https://plugins.trac.wordpress.org/changeset/2916430/google-maps-easy/trunk/classes/frame.php?contextall=1 url
- https://nvd.nist.gov/vuln/detail/CVE-2023-2526 advisory
- https://plugins.trac.wordpress.org/changeset/2916430/ patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea4ca00-185b-4f5d-9c5c-f81ba4edad05?source=cve advisory