CVE-2015-2293

WordPress SEO by Yoast < 1.5.7, 1.6.x < 1.6.4, 1.7.x < 1.7.4 - Cross-Site Request Forgery

Title source: llm
STIX 2.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.

References (6)

Core 6
Core References
Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/7841
Vendor Advisory x_refsource_confirm
https://yoast.com/wordpress-seo-security-release/
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2015/Mar/73
Exploit vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1031920

Scores

EPSS 0.0152
EPSS Percentile 71.6%

Details

CWE
CWE-352
Status published
Products (11)
yoast/wordpress_seo 1.6.0
yoast/wordpress_seo 1.6.1
yoast/wordpress_seo 1.6.2
yoast/wordpress_seo 1.6.3
yoast/wordpress_seo 1.7.1
yoast/wordpress_seo 1.7.2
yoast/wordpress_seo 1.7.3
yoast/wordpress_seo 1.7.3.1
yoast/wordpress_seo 1.7.3.2
yoast/wordpress_seo 1.7.3.3
... and 1 more
Published Mar 17, 2015
Tracked Since Feb 18, 2026