WordPress Copyscape Premium プラグイン <= 1.4.1 - クロスサイトリクエストフォージェリ (CSRF) 脆弱性
プラットフォーム
wordpress
コンポーネント
copyscape-premium
修正版
1.4.2
CVE-2026-24966 describes a Cross-Site Request Forgery (CSRF) vulnerability discovered in Copyscape Premium. This flaw allows an attacker to trick authenticated users into unknowingly performing actions they did not intend, potentially leading to unauthorized modifications or deletions within the Copyscape Premium plugin. The vulnerability impacts versions from 0.0.0 up to and including 1.4.1, and a fix is available in version 1.4.2.
このCVEがあなたのプロジェクトに影響するか確認
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
影響と攻撃シナリオ翻訳中…
A successful CSRF attack against Copyscape Premium could allow an attacker to manipulate user settings, potentially altering plagiarism detection configurations or even deleting user accounts. The attacker would need to craft a malicious request and entice a legitimate user to click a link or visit a webpage containing the crafted request. Given Copyscape Premium's role in content originality checks, unauthorized modifications could have significant implications for website owners and content creators relying on the plugin's functionality. While the direct impact might be limited to the plugin's features, a compromised Copyscape Premium installation could be a stepping stone for further attacks if other vulnerabilities exist within the WordPress environment.
悪用の状況翻訳中…
CVE-2026-24966 was publicly disclosed on 2026-02-03. No public proof-of-concept (POC) code has been released at the time of writing. The vulnerability's EPSS score is likely low to medium, given the reliance on social engineering to execute the attack. It is not currently listed on the CISA KEV catalog.
リスク対象者翻訳中…
Websites utilizing Copyscape Premium plugin versions 0.0.0 through 1.4.1 are at risk. This includes WordPress sites heavily reliant on plagiarism detection for content management and those with shared hosting environments where plugin updates may be delayed or managed by the hosting provider.
検出手順翻訳中…
• wordpress / composer / npm:
grep -r 'copyscape_premium_settings_url' /var/www/html/wp-content/plugins/• generic web:
curl -I https://example.com/copyscape_premium_settings_url | grep -i 'csrf-token'攻撃タイムライン
- Disclosure
disclosure
脅威インテリジェンス
エクスプロイト状況
EPSS
0.02% (4% パーセンタイル)
CISA SSVC
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- なし — 認証不要。資格情報なしで悪用可能。
- User Interaction
- 必要 — 被害者がファイルを開く、リンクをクリックするなどのアクションが必要。
- Scope
- 変化なし — 影響は脆弱なコンポーネントのみ。
- Confidentiality
- なし — 機密性への影響なし。
- Integrity
- 低 — 限定的な範囲でデータ変更可能。
- Availability
- なし — 可用性への影響なし。
影響を受けるソフトウェア
パッケージ情報
- アクティブインストール数
- 1Kニッチ
- プラグイン評価
- 3.2
- WordPressが必要
- 3.0.1+
- 動作確認済みバージョン
- 6.9.4
弱点分類 (CWE)
タイムライン
- 予約済み
- 公開日
- 更新日
- EPSS 更新日
緩和策と回避策翻訳中…
The primary mitigation for CVE-2026-24966 is to immediately upgrade Copyscape Premium to version 1.4.2 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing stricter Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed. Additionally, employing a Web Application Firewall (WAF) with CSRF protection rules can help block malicious requests. Regularly review Copyscape Premium’s configuration and user permissions to minimize potential damage from a successful attack. After upgrading, verify the fix by attempting a CSRF attack using a known payload and confirming that the request is blocked or ignored.
修正方法
バージョン 1.4.2 以上、または最新の修正バージョンにアップデートしてください
CVEセキュリティニュースレター
脆弱性分析と重要アラートをメールでお届けします。
よくある質問翻訳中…
What is CVE-2026-24966 — CSRF in Copyscape Premium?
CVE-2026-24966 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Copyscape Premium versions 0.0.0–1.4.1, allowing attackers to perform unauthorized actions.
Am I affected by CVE-2026-24966 in Copyscape Premium?
You are affected if you are using Copyscape Premium version 0.0.0 through 1.4.1. Upgrade to 1.4.2 or later to mitigate the risk.
How do I fix CVE-2026-24966 in Copyscape Premium?
Upgrade Copyscape Premium to version 1.4.2 or later. Consider implementing CSP headers and a WAF as additional security measures.
Is CVE-2026-24966 being actively exploited?
There is no confirmed active exploitation of CVE-2026-24966 at this time, but it's crucial to apply the patch proactively.
Where can I find the official Copyscape Premium advisory for CVE-2026-24966?
Refer to the Copyscape Premium website or their official security advisory page for the latest information and updates regarding CVE-2026-24966.