CVE-2019-6703

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://wpvulndb.com/vulnerabilities/9208Third Party Advisory
https://www.wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-vulnerabilities-in-total-donations-plugin/Exploit, Third Party Advisory
https://wpvulndb.com/vulnerabilities/9208Third Party Advisory
https://www.wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-vulnerabilities-in-total-donations-plugin/Exploit, Third Party Advisory

Timeline

Published: Jan 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-67067.5Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to tr CVE-2019-67077.2PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state product_id[] parameter.CVE-2019-67087.2PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter.CVE-2019-67108.8Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF.CVE-2019-67139.8app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors invol CVE-2019-67149.8An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can c CVE-2019-67157.5pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL fie CVE-2019-67169.4An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a r CVE-2019-67197.5An issue has been found in libIEC61850 v1.3.1. There is a use-after-free in the getState function in mms/iso_server/iso_server.c, as demonst CVE-2019-67247.8The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process a CVE-2019-67259.8The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 (2.00(AAKK.3)) devices. After accessing the page CVE-2019-67266.5The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fas