CVE-2015-2791
Severity CVSS v4.0:
Pending analysis
Type:
CWE-264
Permissions, Privileges, and Access Control
Publication date:
30/03/2015
Last modified:
12/04/2025
Description
The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php.
Impact
Base Score 2.0
6.40
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:wpml:wpml:*:*:*:*:*:wordpress:*:* | 3.1.8 (including) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://klikki.fi/adv/wpml.html
- http://packetstormsecurity.com/files/130810/WordPress-WPML-XSS-Deletion-SQL-Injection.html
- http://seclists.org/fulldisclosure/2015/Mar/71
- http://www.securityfocus.com/archive/1/534862/100/0/threaded
- https://wpml.org/2015/03/wpml-security-update-bug-and-fix/
- http://klikki.fi/adv/wpml.html
- http://packetstormsecurity.com/files/130810/WordPress-WPML-XSS-Deletion-SQL-Injection.html
- http://seclists.org/fulldisclosure/2015/Mar/71
- http://www.securityfocus.com/archive/1/534862/100/0/threaded
- https://wpml.org/2015/03/wpml-security-update-bug-and-fix/