CVE-2015-9456

MEDIUM EPSS 68.5%
Published Oct 7, 20196y ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Oct 7, 2019 6y ago
Last Modified Jun 17, 2026 2w ago

Description

The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
68.5% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-732

Affected Products 1

VendorProductVersionRange
orbisiuschild_theme_creator* <1.2.8

References 3

  • cinu.pl http://cinu.pl/research/wp-plugins/mail_28c91eee00e8e4b5868ebc58b5b1f730.html
    ExploitThird Party Advisory
  • wordpress.org https://wordpress.org/plugins/orbisius-child-theme-creator/#developers
    ProductRelease Notes
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/8315
    ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.