CVE-2018-20555

critical · 9.8

The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_secret, consumer_key, and consumer_secret values by reading the dcwp_twitter.php source code. This leads to Twitter account takeover.

9.8

CVSS

10.4%

EPSS (exploit prob.)

96th

EPSS percentile

2019-03-21

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-200

Affected products

Vendor	Product	Affected versions
designchemical	social_network_tabs	1.7.1

Check a specific version with /api/v1/cve/match.

References

https://github.com/fs0c131y/CVE-2018-20555
https://twitter.com/fs0c131y/status/1085828186708066304
https://wpvulndb.com/vulnerabilities/9204
https://github.com/fs0c131y/CVE-2018-20555
https://twitter.com/fs0c131y/status/1085828186708066304
https://wpvulndb.com/vulnerabilities/9204

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-20555