Vulnerability in Calmar-Webmedia Total Donations
CVE-2019-6703
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.261 (98.0th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.261 · newest: 0.261 · change: 0.000
Affected products
Public proof-of-concept exploits
References
- www.wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-vulnera… (Exploit, Third Party Advisory)
- wpvulndb.com/vulnerabilities/9208 (Third Party Advisory)
Frequently asked questions
- What is CVE-2019-6703?
- CVE-2019-6703 is a critical-severity vulnerability in Calmar-Webmedia Total Donations. CVSS score: 9.8/10. Published 2019-01-27.
- How severe is CVE-2019-6703?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-6703 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.