CVE-2020-13643: CSRF
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The liveeditorpanelsdata $POST variable allows for malicious JavaScript to be executed in the victim's browser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-13643?
CVE-2020-13643 is rated as a high severity vulnerability due to its potential for unauthorized requests to be executed by an attacker.
How do I fix CVE-2020-13643?
To fix CVE-2020-13643, update the SiteOrigin Page Builder plugin to version 2.10.16 or later.
What type of attack does CVE-2020-13643 facilitate?
CVE-2020-13643 facilitates attacks such as Cross-Site Request Forgery (CSRF) due to the lack of nonce verification in the live editor feature.
Which versions of SiteOrigin Page Builder are affected by CVE-2020-13643?
CVE-2020-13643 affects all versions of SiteOrigin Page Builder prior to 2.10.16.
What impact does CVE-2020-13643 have on WordPress sites?
CVE-2020-13643 can allow attackers to perform unauthorized actions on the site, compromising the security of WordPress installations.