CVE:CVE-2023-3977
CNNVD:CNNVD-202307-2195
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。
WordPress 多款插件存在跨站请求伪造漏洞，该漏洞源于缺少随机数检查，容易受到跨站点请求伪造的影响，这使得未经身份验证的攻击者可以通过伪造的请求安装有限列表中的插件。
solution:Upgrade backupbliss backup_migration to a higher version than 1.2.8,and avoid the version (,1.2.8); Upgrade backupbliss clone to a higher version than 2.3.8,and avoid the version (,2.3.8); Upgrade copy-delete-posts duplicate_post to a higher version than 1.4.0,and avoid the version (,1.4.0); Upgrade inisev redirection to a higher version than 1.1.4,and avoid the version (,1.1.4); Upgrade inisev rss_redirect_&_feedburner_alternative to a higher version than 3.8,and avoid the version (,3.8); Upgrade inisev ssl_mixed_content_fix to a higher version than 3.2.4,and avoid the version (,3.2.4); Upgrade mypopups pop-up to a higher version than 1.2.0,and avoid the version (,1.2.0); Upgrade themecheck enhanced_text_widget to a higher version than 1.5.8,and avoid the version (,1.5.8); Upgrade themecheck ultimate_posts_widget to a higher version than 2.2.5,and avoid the version (,2.2.5); Upgrade ultimatelysocial social_media_share_buttons_&_social_sharing_icons to a higher version than 3.5.8,and avoid the version (,3.5.8)