Vulnerability in Calmar-Webmedia Total Donations
CVE-2019-6703
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
EPSS: 0.261 (97.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Calmar-webmedia Total_donations
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-6703?
- CVE-2019-6703 is a critical-severity vulnerability in Calmar-Webmedia Total Donations. CVSS score: 9.8/10. Published 2019-01-27.
- How severe is CVE-2019-6703?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-6703 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.