CVE-2019-12826

A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers…

published July 1, 2019

CVSS
—
EPSS
1%
Percentile
65.6
In the wild
Unconfirmed
What it is

A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets (that are attached to widgets and then eval'd to dynamically determine their visibility) by crafting a malicious POST request that tricks administrators into adding the code.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01110 · 65.6th percentile
Published
2019-07-01T17:56Z
EPSS history
Timeline
  • 01 JUL 17:56Z
    A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers…
    cvelistv5