Skip to content
Fencer Vulns
critical 9.8

CVE-2019-6703 in the critical feed json

Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unaut…

published 2019-01-27 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-16261

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
26.1%
EPSS 26.1% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known, plus a Nuclei check

Summary

Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

Exploit prediction

26.08% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Total Donations Plugin for WordPress < 2.0.6 - Arbitrary Options Update nuclei detection template
  • wordfence.com https://www.wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-vulnerabilities-in-total-donations-plugin/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.