CVE-2015-2293 Yoast SEO <= 1.7.3.3 - Cross-Site Request Forgery
MediumCVSS 6.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yoast wordpress seo | <= 1.5.6 | No fix listed |
| yoast wordpress seo | = 1.6.0 | No fix listed |
| yoast wordpress seo | = 1.6.1 | No fix listed |
| yoast wordpress seo | = 1.6.2 | No fix listed |
| yoast wordpress seo | = 1.6.3 | No fix listed |
| yoast wordpress seo | = 1.7.1 | No fix listed |
| yoast wordpress seo | = 1.7.2 | No fix listed |
| yoast wordpress seo | = 1.7.3 | No fix listed |
| yoast wordpress seo | = 1.7.3.1 | No fix listed |
| yoast wordpress seo | = 1.7.3.2 | No fix listed |
| yoast wordpress seo | = 1.7.3.3 | No fix listed |
| wordpress-seo(WordPress) | < 1.5.7 | 1.5.7 |
| wordpress-seo(WordPress) | >= 1.6, < 1.6.4 | 1.6.4 |
| wordpress-seo(WordPress) | >= 1.7, < 1.7.4 | 1.7.4 |
References
- packetstormsecurity.com exploit
- 20150312 WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection exploit mailing-list
- 1031920 exploit vdb-entry
- wordpress.org
- wpvulndb.com
- yoast.com vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org