CVE-2017-8099

HIGH

WHIZZ < 1.1 - Cross-Site Request Forgery via GET Request

Title source: llm
STIX 2.1

Description

There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request.

References (2)

Core 2
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://seclists.org/fulldisclosure/2017/Apr/41
Release Notes, Vendor Advisory x_refsource_misc
https://plugins.trac.wordpress.org/browser/whizz/trunk/change_log.txt

Scores

CVSS v3 8.1
EPSS 0.0064
EPSS Percentile 46.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
browserweb_inc/whizz < 1.1
Published Apr 24, 2017
Tracked Since Feb 18, 2026