CVE-2015-3986
Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for…
Does this matter?
Lower severity and a low EPSS score (3.37%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 3.37% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- thecartpress/thecartpress ecommerce shopping cart
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.htmlExploit
- http://www.securityfocus.com/archive/1/535396/100/0/threaded
- http://www.securityfocus.com/bid/74395
- https://wordpress.org/plugins/thecartpress/changelog/
- https://www.exploit-db.com/exploits/36860/Exploit
- https://www.htbridge.com/advisory/HTB23254Exploit
- http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.htmlExploit
- http://www.securityfocus.com/archive/1/535396/100/0/threaded
- http://www.securityfocus.com/bid/74395
- https://wordpress.org/plugins/thecartpress/changelog/
- https://www.exploit-db.com/exploits/36860/Exploit
- https://www.htbridge.com/advisory/HTB23254Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.