WordPress
Multiple vulnerabilities in WP Comment Remix 1.4.3
A number of vulnerabilities have been discovered in the WP Comment Remix 1.4.3 plugin.
The following is a short overview of the vulnerabilities discovered:
SQL Injection: caused by unsanitized variable “p” in the ajax_comments.php file.
Cross Site Scripting: This affects authenticated and unauthenticated users.
Cross Site Request Forgery: the form generated through wpcr_do_options_page lacks the WordPress wp_nonce security function.
These [...]
Wordpress-MU Cross Site Scripting Vulnerability
Product: Wordpress-MU (multi-user)
Version: Versions prior to 2.6 are affected
Credits: Juan Galiana
Juan Galiana has published the advisory to Bugtraq this week which includes a proof of concept exploit.
Wordpress-MU is affected by a Cross Site Scripting vulnerability, an attacker can perform an XSS attack that allows him to access the
targeted user cookies to gain administrator privileges
In [...]
WordPress 2.6.1 Weak Entropy Vulnerability
iso^kpsbr has discovered a vulnerability that may allow an external attacker to gain admin access to WordPress 2.6.1.
WordPress is prone to a weakness in the entropy of generated passwords. Successfully exploiting this issue may allow an attacker to guess randomly generated passwords. WordPress 2.6.1 is vulnerable; other versions may also be affected.
The original advisory and [...]
WordPress Pwnie Awards
The Pwnie Awards, an ‘annual awards ceremony celebrating and making fun of the achievements and failures of security researchers and the wider security community’.
It seems like hardly a week goes by without a new vulnerability in WordPress or one of its many plugins. Many of them are actively being exploited to own popular WordPress [...]
WP Contact-Form Vulnerabilities
WP Contact Form is a very popular WordPress plugin.
Mustlive has reported a number of vulnerabilities which you can view at his web page here.
According to the plugin authors page, the latest version is 3.1.8. We went ahead and downloaded a copy to have a look. The actual contact form page that your users see is [...]
