Unscored severity · published Oct 17, 2014
CVE-2014-2559
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of…
–
CVSS
3.3%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to wp-admin/options-general.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twitget · Twitget Project
through 3.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2559
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2559
Exploit
http://packetstormsecurity.com/files/126134
Exploit
http://seclists.org/fulldisclosure/2014/Apr/172
secunia.com
http://secunia.com/advisories/57892
Vendor Advisory
http://wordpress.org/plugins/twitget/changelog
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/92391
Exploit
https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1
More from Twitget
–
CVE-2014-2995
Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary…