CVE-2023-0497

HT Portfolio < 1.1.6 - Arbitrary Plugin Activation via CSRF

CVSS 4.3 MEDIUMEPSS 0.3%CWE-352

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

27 Mar 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

Unknown · HT Portfolio

References

https://wpscan.com/vulnerability/ae5b7776-9d0d-4db8-81c3-237b16cd9c62