CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies.
AnalysisAI
The Gtbabel WordPress plugin before version 6.6.9 fails to validate that analyzed URLs belong to the legitimate website, allowing attackers to trick users into visiting malicious links that steal their login cookies. This affects any WordPress site running the vulnerable plugin version. An attacker could craft a specially designed URL that, when clicked by an admin or logged-in user, exposes their session cookies, potentially giving the attacker full account access.
Technical ContextAI
affects Gtbabel WordPre. The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies.
Affected ProductsAI
Product: Gtbabel WordPre. Versions: up to 6.6.9.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Share
External POC / Exploit Code
Leaving vuln.today