CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37391 – WordPress WordPress Mobile Pack Plugin <= 3.4.1 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-37391
Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin <= 3.4.1 versions. The WordPress Mobile Pack plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.1. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/wordpress-mobile-pack/wordpress-wordpress-mobile-pack-plugin-3-4-1-broken-access-control-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2015-9269 – WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps < 2.1.3 - Sensitive Information Exposure
https://notcve.org/view.php?id=CVE-2015-9269
The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensitive information because the content of a privately published post is sent in JSON format. La característica exportarticle en export/content.php en el plugin wordpress-mobile-pack en versiones anteriores a la 2.1.3 2015-06-03 para WordPress permite que atacantes remotos obtengan información sensible debido a que el contenido de una publicación publicada de forma privada se envía en formato JSON. The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 for WordPress allows remote attackers to obtain sensitive information because the content of a privately published post is sent in JSON format. • https://seclists.org/fulldisclosure/2015/Jul/97 https://wordpress.org/plugins/wordpress-mobile-pack/#developers https://www.openwall.com/lists/oss-security/2015/07/19/1 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 2%CPEs: 16EXPL: 1CVE-2014-5337 – WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps < 2.0.2 - Information Disclosure
https://notcve.org/view.php?id=CVE-2014-5337
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php. El plugin WordPress Mobile Pack anterior a 2.0.2 para WordPress no restringe debidamente el acceso a los puesto protegidos por contraseña, lo que permite a atacantes remotos obtener información sensible a través de una acción exportarticles en export/content.php. • http://secunia.com/advisories/60584 http://wordpress.org/plugins/wordpress-mobile-pack/changelog http://www.securityfocus.com/bid/69292 https://security.dxw.com/advisories/information-disclosure-vulnerability-in-wordpress-mobile-pack-allows-anybody-to-read-password-protected-posts • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-264: Permissions, Privileges, and Access Controls •