CVE-2019-12826

ALTO 8.8CVE-2019-12826 · Published 01/07/2019 · updated 17/06/2026

In breve

CVE-2019-12826 è una vulnerabilità ALTO (CVSS 8.8) che riguarda widget logic (wpchef).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 66.1% delle vulnerabilità.
Correzione: aggiornare a 5.10.2 o successiva.

Package	Affected versions	Patched versions
widget logic wpchef	`< 5.10.2`	`5.10.2`

Description

A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets (that are attached to widgets and then eval'd to dynamically determine their visibility) by crafting a malicious POST request that tricks administrators into adding the code.

References

dannewitz.ninja/posts/widget-logic-csrf-to-rce · Exploit
plugins.trac.wordpress.org/changeset/2112753/widget-logic · Third Party Advisory
wpvulndb.com/vulnerabilities/9403
wpvulndb.com/vulnerabilities/9413

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free