CVE-2019-6703

published 2019-01-27

CVE-2019-6703: Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers…

Priority P1 84 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
calmar-webmedia	total_donations	<= 2.0.5	—

Detection & IOCs extracted from sources · hover to see the quote

path /wp-admin/admin-ajax.php↗

path /wp-content/plugins/total-donations/readme.txt↗

filename migla_ajax_functions.php↗

command miglaA_update_me↗

• → Detect unauthenticated POST requests to /wp-admin/admin-ajax.php containing the 'miglaA_update_me' action parameter, which indicates exploitation of the Total Donations plugin arbitrary options update vulnerability. ↗
• → Fingerprint vulnerable installations by probing /wp-content/plugins/total-donations/readme.txt and extracting the 'Stable tag' version; versions below 2.0.6 are vulnerable. ↗
• → Use FOFA/Shodan body-search query body="/wp-content/plugins/total-donations/" to identify internet-exposed WordPress sites running the vulnerable Total Donations plugin. ↗
• → Monitor WordPress option changes for 'users_can_register' being set to enabled and 'default_role' being set to 'administrator', which are the post-exploitation indicators of this attack. ↗

• · The vulnerability affects Total Donations plugin versions through 2.0.5 only; version 2.0.6 and above are not affected. Version-check logic should use a strict less-than comparison against 2.0.6. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.