CVEvulnerability
CVE-2013-2640
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-03-22
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to "formData=save" requests, a different version than CVE-2013-0731.
Affected configurations
• mailup wp-mailup (<= 1.3.1)
• mailup wp-mailup 1.0.0
• mailup wp-mailup 1.1.0
• mailup wp-mailup 1.1.1
• mailup wp-mailup 1.1.2
• mailup wp-mailup 1.1.3
• mailup wp-mailup 1.2
• mailup wp-mailup 1.3
• mailup wp-mailup 1.21
Related
Weakness · not in database (1)
References
- http://osvdb.org/91274 osvdb.org
- http://plugins.trac.wordpress.org/changeset?new=682420 Exploit, Patch
- http://secunia.com/advisories/51917 Vendor Advisory
- http://wordpress.org/extend/plugins/wp-mailup/changelog/ wordpress.org
- http://osvdb.org/91274 osvdb.org
- http://plugins.trac.wordpress.org/changeset?new=682420 Exploit, Patch
- http://secunia.com/advisories/51917 Vendor Advisory
- http://wordpress.org/extend/plugins/wp-mailup/changelog/ wordpress.org