CVE-2015-2792

Published: Mar 30, 2015Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perform arbitrary actions via a request containing an action POST parameter, an action GET parameter, and a valid nonce for the action GET parameter.

Affected (1)

Products: Wpml: Wpml

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wpml Wpml	Up to 3.1.8

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (8)

http://klikki.fi/adv/wpml.html

Source: cve@mitre.org

Exploit

http://packetstormsecurity.com/files/130839/WordPress-WPML-Missing-Authentication.html

Source: cve@mitre.org

Exploit

http://seclists.org/fulldisclosure/2015/Mar/79

Source: cve@mitre.org

Exploit

http://wpml.org/2015/03/wpml-security-update-bug-and-fix/

Source: cve@mitre.org

Vendor Advisory

http://klikki.fi/adv/wpml.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://packetstormsecurity.com/files/130839/WordPress-WPML-Missing-Authentication.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://seclists.org/fulldisclosure/2015/Mar/79

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://wpml.org/2015/03/wpml-security-update-bug-and-fix/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.