WordPress security changelog
MEDIUM CVE-2021-4411 Modified

WP EasyPay – Square for: Cross-site request forgery

WP EasyPay – Square for is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

CVE / CNA score 4.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
WP EasyPay – Square for
Plugin slug
wp-easy-pay
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Jul 12, 2023
Weakness
CWE-352 — Cross-Site Request Forgery (CSRF)

This CVE was published Jul 12, 2023 and is one of 8 known issues for this plugin.

What to do

Patch or disable the affected component.

Update WP EasyPay – Square for to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the wpep_download_transaction_in_excel() function. This makes it possible for unauthenticated attackers to trigger a transactions download via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

Primary and upstream sources