CVE-2018-3810
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert...
- Published
- Jan 1, 2018
- Updated
- Aug 5, 2024
- Assigning CNA
- mitre
- Evidence observed
- Jan 3, 2018
Primary CVSS
nvd · CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.8%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.
Sources
http/cves/2018/CVE-2018-3810.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)
- cve-2018-3810Research
Docker container providing a vulnerable environment for CVE-2018-3810, designed for security testing and educational exploitation practice within isolated containers.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.