Lws Tools Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.3.1 versions.

Affected:

up to 2.4

Fixed in:

2.4

Disclosed:

Nov 22, 2023

CVE-2023-27453 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.4.1 versions.

Affected:

up to 2.4.2

Fixed in:

2.4.2

Disclosed:

Jul 11, 2023

CVE-2023-35774 on NVD →

The LWS Tools plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administra...

CVSS:

5.4

Affected:

up to 2.4.1

Fixed in:

2.4.2

Disclosed:

Jun 16, 2023

CVE-2023-35774 on NVD →

The LWS Tools plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on 'lws_tk_create_page' function and several AJAX actions. This makes it possible for unauthenticated attackers to modify the database prefix, modi...

CVSS:

7.1

Affected:

up to 2.3.1

Fixed in:

2.4

Disclosed:

Mar 2, 2023

CVE-2023-27453 on NVD →

Several LWS Plugins for WordPress are vulnerable to authorization bypass due to making admin settings pages available to users with read access (LWS Affiliation in versions up to, and including, 2.1; LWS Optimize in versions up to, and including, 1.5; LWS Tools in versions up to, and including, 2.1; LWS Cleaner in vers...

CVSS:

8.8

Affected:

up to 2.1

Fixed in:

2.2

Disclosed:

Dec 12, 2022

Several LWS Plugins for WordPress are vulnerable to authorization bypass due to making admin settings pages available to users with read access (LWS Affiliation in versions up to, and including, 2.1; LWS Optimize in versions up to, and including, 1.5; LWS Tools in versions up to, and including, 2.1; LWS Cleaner in vers...

Affected:

up to 2.2

Fixed in:

2.2

Disclosed:

Dec 12, 2022