Skip to content
Sign in
4.3 Medium

CVE-2020-36756 The 10WebAnalytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,…

Description

The 10WebAnalytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.8. This is due to missing or incorrect nonce validation on the create_csv_file() function. This makes it possible for unauthenticated attackers to create a CSV file via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products and versions

Product Affected versions Fixed in
10WebAnalytics 1.2 earliest → < 1.2.9 1.2.9

Other CVEs of 10WebAnalytics

The 2 CVEs of 10WebAnalytics →
CVE-2023-47807 Missing Authorization vulnerability in 10Web 10WebAnalytics wd-google-analytics allows Exploiting Incorrectly Configured… 4.3 Medium
Track this CVE