CVE-2018-3810 - CVE House
Back to Database
Status published Critical CVE-2018-3810

Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter...

Vulnerability Description

Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-3810

Credits & Attribution

No credits recorded in the NVD database.

References

More from oturia

View All →
CVE-2018-3811
SQL Injection vulnerability in the Oturia Smart Google Code Inserter...
Critical 9.8

Affected Vendor

Affected Software

smart google code inserter
Vulnerable Versions:
0

Timeline

Official Publish: January 1st, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.