CVE-2017-12651

EUVD-2017-4190
Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 31%
Affected Products (NVD)
VendorProductVersion
loginizerloginizer
𝑥
≤ 1.3.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://blog.wpscans.com/sql-injection-and-csrf-security-vulnerability-in-loginizer/
https://sv.wordpress.org/plugins/loginizer/#developers
https://wpvulndb.com/vulnerabilities/8884
https://blog.wpscans.com/sql-injection-and-csrf-security-vulnerability-in-loginizer/
https://sv.wordpress.org/plugins/loginizer/#developers
https://wpvulndb.com/vulnerabilities/8884