CVE-2014-2559

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-10-17 · updated 2026-06-17
Weakness: CWE-352

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to wp-admin/options-general.php.

Affected products

Twitget Project Twitget: through 3.3.1

References

http://packetstormsecurity.com/files/126134
http://seclists.org/fulldisclosure/2014/Apr/172
http://secunia.com/advisories/57892
http://wordpress.org/plugins/twitget/changelog
https://exchange.xforce.ibmcloud.com/vulnerabilities/92391
https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1
http://packetstormsecurity.com/files/126134
http://seclists.org/fulldisclosure/2014/Apr/172
http://secunia.com/advisories/57892
http://wordpress.org/plugins/twitget/changelog
https://exchange.xforce.ibmcloud.com/vulnerabilities/92391
https://security.dxw.com/advisories/csrfxss-vulnerability-in-twitget-3-3-1

Get alerted when CVE-2014-2559 or the next vulnerability affects your stack