4.3med
CVE-2016-20074
WordPress Lazy Content Slider Plugin 3.4 CSRF
Published 4 mo ago · modified 3 mo ago · JSON
CVSS
4.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.1%
percentile 1%
Public exploits
0
none known
Summary
WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via lzcs_admin.php to modify plugin configuration parameters like lzcs_color and lzcs_count.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction (EPSS)
0.10% probability of exploitation in the next 30 days, higher than 1% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected products
- leethompson Lazy Content Slider Plugin
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- exploit-db.com /exploits/40070 · exploit
- vulncheck.com /advisories/wordpress-lazy-content-slider-plugin-csrf · third-party-advisory
Sources
- CVE List: CVE-2016-20074
- NVD: CVE-2016-20074
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.