CVE-2020-12073 : Security Advisory and Response

The responsive-add-ons plugin before 2.2.7 for WordPress has an access control issue for specific requests in wp-admin/admin-ajax.php.

Understanding CVE-2020-12073

This CVE involves a vulnerability in the responsive-add-ons plugin for WordPress that could be exploited by attackers.

What is CVE-2020-12073?

The plugin before version 2.2.7 has incorrect access control for certain requests, potentially leading to security breaches.

The Impact of CVE-2020-12073

The vulnerability has a CVSS base score of 9.1, classified as critical due to high integrity impact and low confidentiality impact.

Technical Details of CVE-2020-12073

The following are technical details of the CVE.

Vulnerability Description

The plugin lacks proper access control for specific requests, making it susceptible to exploitation.

Affected Systems and Versions

Product: Not applicable
Vendor: Not applicable
Versions affected: Not applicable

Exploitation Mechanism

Attack Complexity: Low
Attack Vector: Network
Privileges Required: Low
User Interaction: None

Mitigation and Prevention

Steps to address and prevent the CVE.

Immediate Steps to Take

Update the responsive-add-ons plugin to version 2.2.7 or newer.
Monitor wp-admin/admin-ajax.php?action= requests for suspicious activities.

Long-Term Security Practices

Regularly update all WordPress plugins and themes.
Implement strong access control mechanisms to prevent unauthorized requests.

Patching and Updates

Apply patches and updates promptly to ensure the security of the WordPress site.