WordPress CWW Companion plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability

The CSRF vulnerability in CWW Companion allows an attacker to craft malicious requests that appear to originate from a legitimate user. By tricking a user into clicking a crafted link or visiting a compromised website, an attacker could potentially modify settings, create or delete content, or perform other actions as if they were the authenticated user. The impact is amplified if the plugin has administrative privileges, potentially granting the attacker full control over the WordPress site. This could lead to data breaches, website defacement, or even complete compromise of the server.

WordPress websites utilizing the CWW Companion plugin, particularly those with users who have administrative privileges or handle sensitive data, are at risk. Shared hosting environments where plugin updates are managed centrally should prioritize patching to prevent widespread compromise.

• wordpress / composer / npm:

grep -r 'cww-companion/includes/functions.php' /var/www/html/

• wordpress / composer / npm:

wp plugin list | grep cww-companion

• wordpress / composer / npm:

wp plugin update cww-companion --all

1. 2025-12-09Disclosure

   disclosure

1. Reserviert2025-12-08
2. Veröffentlicht2025-12-09
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade the CWW Companion plugin to version 1.3.3 or later, which contains the fix. If upgrading immediately is not possible, implement a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, carefully review and validate all user inputs to prevent unexpected actions. Consider implementing stricter access controls and user permissions to limit the potential damage from a successful attack. After upgrading, confirm the vulnerability is resolved by attempting a CSRF attack and verifying it is blocked.

Aktive Installationen

1KNische

Plugin-Bewertung