CVE-2019-11591

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-352 CWE-829

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2019/Apr/37Exploit, Mailing List, Third Party Advisory
https://lists.openwall.net/full-disclosure/2019/04/05/12Exploit, Mailing List, Third Party Advisory
https://wordpress.org/plugins/contact-form-maker/#developersThird Party Advisory
https://wpvulndb.com/vulnerabilities/9252Third Party Advisory
http://seclists.org/fulldisclosure/2019/Apr/37Exploit, Mailing List, Third Party Advisory
https://lists.openwall.net/full-disclosure/2019/04/05/12Exploit, Mailing List, Third Party Advisory
https://wordpress.org/plugins/contact-form-maker/#developersThird Party Advisory
https://wpvulndb.com/vulnerabilities/9252Third Party Advisory

Timeline

Published: Apr 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-115926.1WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/CVE-2019-115938.1In Adblock Plus before 3.5.2, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when CVE-2019-115948.1In AdBlock before 3.45.0, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a we CVE-2019-115959.0In uBlock before 0.9.5.15, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a w CVE-2019-115967.5In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of serv CVE-2019-115978.1In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacke CVE-2019-115988.1In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker CVE-2019-115997.0The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags ch CVE-2019-116008.1A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands v CVE-2019-116017.5A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gatewa CVE-2019-116025.3Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9 CVE-2019-116037.5A HTTP Traversal Attack in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2 allows remote attackers to read