Input validation vulnerability in Envo Extra 1.8.4

The Envo Extra plugin for WordPress is vulnerable to a security issue called Cross-Site Request Forgery. This issue affects versions up to and including version 1.8.3. The problem is caused by either missing or incorrect validation of a security measure called a “nonce” on the ajax_required_plugins_activate function. This means that someone who doesn’t have permission to access the website can activate plugins required by Envo Extra by tricking someone with access to the website into clicking on a link.

Detected in:

Envo Extra fixed vulnerable versions: >= * < 1.8.4

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

Is this information incorrect? Please leave us a message.