What is CVE-2014-4163?

CVE-2014-4163 is a vulnerability in Featured Comments Plugin Project, classified under Cross-Site Request Forgery (CSRF). Published 2014-06-16.

Is CVE-2014-4163 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CSRF in Featured Comments Plugin Project

CVE-2014-4163

Multiple cross-site request forgery (CSRF) vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the (1) buried or (2) featured status of a comment via a request to wp-admin/admin-ajax.php.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.026 (83.5th percentile) — read the EPSS interpretation.

Affected products

Featured_comments_plugin_project Featured_comments — versions 1.2.1
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

Public proof-of-concept exploits

20142995/nuclei-templates

References

cve@mitre.org (mailing-list, Exploit, x_refsource_FULLDISC)

Frequently asked questions

What is CVE-2014-4163?: CVE-2014-4163 is a vulnerability in Featured Comments Plugin Project, classified under Cross-Site Request Forgery (CSRF). Published 2014-06-16.
Is CVE-2014-4163 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.