CVE-2015-0895

Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.

Score

CVSS 2.0 6.8 Medium

Status

Modified - vultures@jpcert.or.jp

Published

2015-03-07

Last modified

2024-08-06

Weaknesses

CWE-352

Affected products

• All In One Wordpress Security And Firewall (Tips And Tricks Hq)

References

• http://jvn.jp/en/jp/JVN87204433/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000038
• https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/