Astra Import Export Vulnerabilities

[en] The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the astra_admin_errors() function. This makes it possible for unauthenticated attackers to display an import stat...

Affected:

up to 1.0.4

Fixed in:

1.0.4

Disclosed:

Jul 1, 2023

CVE-2020-36737 on NVD →

Affected:

up to 1.0.4

Fixed in:

1.0.4

Disclosed:

Jun 7, 2023

CVE-2021-4342 on NVD →

The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the astra_admin_errors() function. This makes it possible for unauthenticated attackers to display an import status vi...

CVSS:

4.3

Affected:

up to 1.0.4

Fixed in:

1.0.4

Disclosed:

Sep 16, 2020

CVE-2020-36737 on NVD →

Cross-Site Request Forgery (CSRF) vulnerability found by Jerome Bruandet (NinTechNet) in WordPress Import / Export Customizer Settings plugin (versions <= 1.0.3).

Affected:

up to 1.0.4

Fixed in:

1.0.4

Disclosed:

Sep 16, 2020

Over 70 plugins and themes were vulnerable to Cross-Site Request Forgery due to improperly implemented nonce protection that could be bypassed.

Affected:

up to 1.0.4

Fixed in:

1.0.4