Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can use AJAX features of the MailUp plugin of
WordPress, in order to alter its configuration.

Impacted products: WordPress

Severity: 2/4

Creation date: 14/03/2013

DESCRIPTION OF THE VULNERABILITY

The MailUp plugin of WordPress is used to manage marketing
campaigns.

The AJAX interface (wp-content/plugins/wp-mailup/ajax.functions.php)
of MailUp is used to interact with this plugin. However, access
permissions via the "wordpress_logged_in_test" cookie are not
checked.

An attacker can therefore use AJAX features of the MailUp plugin
of WordPress, in order to alter its configuration.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/WordPress-altering-the-configuration-of-MailUp-12525