Travelpayouts: All Travel Brands in One Place, e0a7d8897771e852dbfe2e2a566b536c7e908324

CVE, Research URL: e0a7d8897771e852dbfe2e2a566b536c7e908324
Home page URL: Security reports for Travelpayouts: All Travel Brands in One Place
Application: Travelpayouts: All Travel Brands in One Place
Published on: Sep 13, 2021
Research Description: Travelpayouts: All Travel Brands in One Place [travelpayouts] < 1.0.17 Travelpayouts <= 1.0.16 - Cross-Site Request Forgery The Travelpayouts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.16. This is due to missing or incorrect nonce validation in the outdated Redux Framework. This makes it possible for unauthenticated attackers to gain restricted access to administrative actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 1.0.17.
Status: vulnerable