CVE-2011-0760

WP Related Posts <= 1.0 - Cross-Site Request Forgery

Severity Score

7.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the (1) wp_relatedposts_title, (2) wp_relatedposts_num, or (3) wp_relatedposts_type parameter.

Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en la pantalla de configuración en wp-relatedposts.php del plugin WP Related Posts v1.0 de WordPress, permite a atacantes remotos secuestrar la autenticación de los administradores en peticiones que insertan secuencias de comandos en sitios cruzados(XSS) en los parámetros(1) wp_relatedposts_title, (2)wp_relatedposts_num, o (3)wp_relatedposts_type.

*Credits: Gabriel Quadros,Rodrigo Rubira Branco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-02-03 CVE Reserved
2011-03-17 CVE Published
2023-03-07 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-352: Cross-Site Request Forgery (CSRF)

CAPEC

References (5)

URL	Tag	Source
http://archives.neohapsis.com/archives/fulldisclosure/2011-03/0205.html	Mailing List
http://www.securityfocus.com/bid/46908	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/66166	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/66168	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/43777	2017-08-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Adminofsystem Search vendor "Adminofsystem"	Wp Related Posts Search vendor "Adminofsystem" for product "Wp Related Posts"	1.0 Search vendor "Adminofsystem" for product "Wp Related Posts" and version "1.0"	-	Affected	in	Wordpress Search vendor "Wordpress"	Wordpress Search vendor "Wordpress" for product "Wordpress"	*	-	Safe