CVE-2012-10015: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the function twttr_settings_page of the file twitter.php of the component Settings Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 2.15 is able to address this issue. The patch is identified as a6d4659cbb2cbf18ccb0fb43549d5113d74e0146. It is recommended to upgrade the affected component. VDB-230154 is the identifier assigned to this vulnerability.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-05-31T00:15Z
Repository: https://github.com/wp-plugins/twitter-plugin
Language: Other
Files changed: languages/twitter-ar_AR.po, languages/twitter-he_IL.po, languages/twitter-ru_RU.po, readme.txt, twitter.php
Commit date: 2012-07-24 17:05:32 +0000
Commit message: V2.15 - Arabic language file is added to the plugin. Cross Site Request Forgery bug was fixed.

git-svn-id: https://plugins.svn.wordpress.org/twitter-plugin/trunk@576723 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/languages/twitter-ar_AR.mo b/languages/twitter-ar_AR.mo
new file mode 100644
index 0000000..3c2fb1c
Binary files /dev/null and b/languages/twitter-ar_AR.mo differ
diff --git a/languages/twitter-ar_AR.po b/languages/twitter-ar_AR.po
new file mode 100644
index 0000000..29383dc
--- /dev/null
+++ b/languages/twitter-ar_AR.po
@@ -0,0 +1,136 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: twitter\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2012-07-24 20:03+0300\n"
+"PO-Revision-Date: 2012-07-24 20:03+0300\n"
+"Last-Translator: zos <zos@bestwebsoft.com>\n"
+"Language-Team: Albayan Design Hani Aladoli <info@albayan-design.com>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-KeywordsList: __;_e\n"
+"X-Poedit-Basepath: ..\n"
+"X-Poedit-Language: arabic\n"
+"X-Poedit-Country: libya\n"
+"X-Poedit-SourceCharset: utf-8\n"
+"X-Poedit-SearchPath-0: .\n"
+
+#: twitter.php:80
+msgid "Activated plugins"
+msgstr "الاضافات المفعلة "
+
+#: twitter.php:82
+#: twitter.php:90
+#: twitter.php:98
+msgid "Read more"
+msgstr "اقراء المزيد"
+
+#: twitter.php:82
+#: twitter.php:245
+#: twitter.php:254
+msgid "Settings"
+msgstr "الاعدادت "
+
+#: twitter.php:88
+msgid "Installed plugins"
+msgstr "الاضافات المركبة"
+
+#: twitter.php:96
+msgid "Recommended plugins"
+msgstr "اضافات موصي بها"
+
+#: twitter.php:98
+msgid "Download"
+msgstr "تحميل"
+
+#: twitter.php:98
+#, php-format
+msgid "Install %s"
+msgstr "تركيب %s"
+
+#: twitter.php:98
+msgid "Install now from wordpress.org"
+msgstr "نزلها الان من wordpress.org"
+
+#: twitter.php:100
+msgid "If you have any questions, please contact us via plugin@bestwebsoft.com or fill in our contact form on our site"
+msgstr "اذا كان لديك اي استفسار او سؤال الرجاء الاتصال بنا عبر بريدنا الالكتروني :  contact us via plugin@bestwebsoft.com  , او المراسلة الفورية من واجهة الاتصال بنا علي موقعنا الخاص"
+
+#: twitter.php:131
+#: twitter.php:153
+msgid "Twitter Options"
+msgstr "خيارات التويتر"
+
+#: twitter.php:131
+msgid "Twitter"
+msgstr "التويتر"
+
+#: twitter.php:149
+msgid "Options saved."
+msgstr "تم حفظ الخيارات"
+
+#: twitter.php:160
+msgid "Settings for the button \"Follow Me\":"
+msgstr "اعدادات زر \"Follow Me\":"
+
+#: twitter.php:164
+msgid "Enter your username:"
+msgstr "اكتب اسم المستخدم :"
+
+#: twitter.php:168
+msgid "If you do not have Twitter account yet you need to create it using this link"
+msgstr "اذا كنت لا تملك حساب علي التويتر يمكنك انشاء حساب جديد عبر هذه الرابط"
+
+#: twitter.php:169
+msgid "Put a shortcode [follow_me] on necessary page or post to use \"Follow Me\" button."
+msgstr "ضع هذه الكود [follow_me]في الصفحات المطلوبه او في المواضيع  \"Follow Me\" زر."
+
+#: twitter.php:170
+msgid "If you would like to utilize this button in another place, please put strings below into the template source code"
+msgstr "إذا كنت ترغب في الاستفادة من هذا الزر في مكان آخر، يرجي وضع الاعدادات في الاسفل ( مربع الكود )"
+
+#: twitter.php:174
+msgid "Settings for the button \"Twitter\":"
+msgstr "اعدادات لهذه الزر  \"Twitter\":"
+
+#: twitter.php:178
+msgid "Choose a position for an icon \"Twitter\":"
+msgstr "اختار مكان لوضع ايقونه  \"Twitter\":"
+
+#: twitter.php:181
+msgid "Top position"
+msgstr "في الاعلي "
+
+#: twitter.php:182
+msgid "Bottom position"
+msgstr "في الاسفل"
+
+#: twitter.php:183
+msgid "When clicking this sign a user adds to their twitter page article that they liked along with a link to it."
+msgstr "عند النقر على هذا العلامة على أن يضيف المستخدم إلى صفحة مقالتهم في تويتر مع روابطها"
+
+#: twitter.php:188
+msgid "Save Changes"
+msgstr "حفظ الاعدادت"
+
+#: twitter.php:224
+msgid "Click here if you liked this article."
+msgstr "اضغط هنا اذا اعجبك هذه المقال"
+
+#: twitter.php:255
+msgid "FAQ"
+msgstr "أسئلة وأجوبة"
+
+#: twitter.php:256
+msgid "Support"
+msgstr "الدعم"
+
+#~ msgid "BWS Plugins"
+#~ msgstr "Плагины BWS"
+#~ msgid "Install Now"
+#~ msgstr "Установить сейчас"
+#~ msgid "Twitter options"
+#~ msgstr "Опции Twitter"
+
diff --git a/languages/twitter-he_IL.mo b/languages/twitter-he_IL.mo
index b86f2ba..db67099 100644
Binary files a/languages/twitter-he_IL.mo and b/languages/twitter-he_IL.mo differ
diff --git a/languages/twitter-he_IL.po b/languages/twitter-he_IL.po
index ced954e..596b4b8 100644
--- a/languages/twitter-he_IL.po
+++ b/languages/twitter-he_IL.po
@@ -1,11 +1,11 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: Twitter Plugin v2.13\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2012-07-12 11:43+0300\n"
-"PO-Revision-Date: 2012-07-12 11:43+0300\n"
+"POT-Creation-Date: 2012-07-24 20:03+0300\n"
+"PO-Revision-Date: 2012-07-24 20:03+0300\n"
 "Last-Translator: zos <zos@bestwebsoft.com>\n"
 "Language-Team: \n"
 "Language: \n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -31,12 +31,12 @@ msgstr "תוספים פעילים"
 msgid "Read more"
 msgstr "קרא עוד"
 
 # @ twitter
 #: twitter.php:82
-#: twitter.php:244
-#: twitter.php:253
+#: twitter.php:245
+#: twitter.php:254
 msgid "Settings"
 msgstr "הגדרות"
 
 # @ twitter
 #: twitter.php:88
@@ -139,19 +139,19 @@ msgstr "כאשר משתמש לוחץ על סמל זה, הוא מוסיף לטו
 #: twitter.php:188
 msgid "Save Changes"
 msgstr "שמור שינויים"
 
 # @ twitter
-#: twitter.php:223
+#: twitter.php:224
 msgid "Click here if you liked this article."
 msgstr "אם אהבת את המאמר לחץ כאן."
 
 # @ twitter
-#: twitter.php:254
+#: twitter.php:255
 msgid "FAQ"
 msgstr "שאלות ותשובות"
 
 # @ twitter
-#: twitter.php:255
+#: twitter.php:256
 msgid "Support"
 msgstr "תמיכה"
 
diff --git a/languages/twitter-ru_RU.mo b/languages/twitter-ru_RU.mo
index 05a37c2..3180112 100644
Binary files a/languages/twitter-ru_RU.mo and b/languages/twitter-ru_RU.mo differ
diff --git a/languages/twitter-ru_RU.po b/languages/twitter-ru_RU.po
index 16729e9..353c7ae 100644
--- a/languages/twitter-ru_RU.po
+++ b/languages/twitter-ru_RU.po
@@ -1,11 +1,11 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: twitter\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2012-07-12 11:43+0300\n"
-"PO-Revision-Date: 2012-07-12 11:43+0300\n"
+"POT-Creation-Date: 2012-07-24 20:03+0300\n"
+"PO-Revision-Date: 2012-07-24 20:03+0300\n"
 "Last-Translator: zos <zos@bestwebsoft.com>\n"
 "Language-Team: bestwebsoft.com <plugin@bestwebsoft.com>\n"
 "Language: \n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -26,12 +26,12 @@ msgstr "Активированные плагины"
 #: twitter.php:98
 msgid "Read more"
 msgstr "Читать далее"
 
 #: twitter.php:82
-#: twitter.php:244
-#: twitter.php:253
+#: twitter.php:245
+#: twitter.php:254
 msgid "Settings"
 msgstr "Настройки"
 
 #: twitter.php:88
 msgid "Installed plugins"
@@ -113,19 +113,19 @@ msgstr "При нажатии этой иконки пользователь д
 
 #: twitter.php:188
 msgid "Save Changes"
 msgstr ""
 
-#: twitter.php:223
+#: twitter.php:224
 msgid "Click here if you liked this article."
 msgstr "Кликай, если понравилась данная статья."
 
-#: twitter.php:254
+#: twitter.php:255
 msgid "FAQ"
 msgstr "FAQ"
 
-#: twitter.php:255
+#: twitter.php:256
 msgid "Support"
 msgstr "Поддержка"
 
 #~ msgid "BWS Plugins"
 #~ msgstr "Плагины BWS"
diff --git a/readme.txt b/readme.txt
index 5746525..cda5498 100644
--- a/readme.txt
+++ b/readme.txt
@@ -2,11 +2,11 @@
 Contributors: bestwebsoft
 Donate link: https://www.2checkout.com/checkout/purchase?sid=1430388&quantity=10&product_id=13
 Tags: tvit, twit, twet, tvet, tvitt, twitt, twett, tvett, tviter, twiter, tweter, twiter, follow button, twitter follow button, twitter share, twitter follow, twitter share button, button, connect, twitter connect, twiter conect, tweet, tweeter, tweetter 
 Requires at least: 2.9
 Tested up to: 3.4.1
-Stable tag: 2.14
+Stable tag: 2.15
 
 Add Twitter follow button to your WordPress website.
 
 == Description ==
 
@@ -21,10 +21,11 @@ Twitter plugin allows you to add follow button in the most easily and flexible w
 * Actions: Ability to add twitter like button in the most easiest and flexible way.
 * Display: This plugin allows you to select the position for the button: top, bottom.
 
 = Translation =
 
+* Arabic (ar_AR) (thanks to Albayan Design Hani Aladoli)
 * Hebrew (he_IL) (thanks to Sagive SEO)
 * Russian (ru_RU)
 
 If you create your own language pack or update the existing one, you can send <a href="http://codex.wordpress.org/Translating_WordPress" target="_blank">the text of PO and MO files</a> for <a href="http://bestwebsoft.com/" target="_blank">BWS</a> and we'll add it to the plugin. You can download the latest version of the program for work with PO and MO files  <a href="http://www.poedit.net/download.php" target="_blank">Poedit</a>.
 
@@ -69,10 +70,14 @@ If you create your own language pack or update the existing one, you can send <a
 5. Shortcode display at the page.
 6. Shortcode settings.
 
 == Changelog ==
 
+= V2.15 - 24.07.2012 =
+* NEW : Arabic language file is added to the plugin.
+* Bugfix : Cross Site Request Forgery bug was fixed.
+
 = V2.14 - 10.07.2012 =
 * NEW : Hebrew language file is added to the plugin.
 * Update : We updated all functionality for wordpress 3.4.1.
 
 = V2.13 - 27.06.2012 =
@@ -132,10 +137,13 @@ If you create your own language pack or update the existing one, you can send <a
 = V1.00 =
 * Ability to install Twitter icon with a link to the account page, including adjustment functionality settings via WordPress admin panel are added.
 
 == Upgrade Notice ==
 
+= V2.15 =
+Arabic language file is added to the plugin. Cross Site Request Forgery bug was fixed.
+
 = V2.14 =
 Hebrew language file is added to the plugin. We updated all functionality for wordpress 3.4.1.
 
 = V2.13 =
 We updated all functionality for wordpress 3.4.
diff --git a/twitter.php b/twitter.php
index 4328938..750ea90 100644
--- a/twitter.php
+++ b/twitter.php
@@ -2,11 +2,11 @@
 /*
 Plugin Name: Twitter Plugin
 Plugin URI:  http://bestwebsoft.com/plugin/
 Description: Plugin to add a link to the page author to twitter.
 Author: BestWebSoft
-Version: 2.14
+Version: 2.15
 Author URI: http://bestwebsoft.com/
 License: GPLv2 or later
 */
 
 /*
@@ -140,11 +140,11 @@ if(!function_exists ( 'twttr_add_pages' ) ) {
 if (!function_exists ( 'twttr_settings_page' ) ) {
 	function twttr_settings_page () {
 		global $twttr_options_array;
 		$message = "";
 		$error = "";
-		if ( isset ( $_REQUEST['twttr_position'] ) && isset ( $_REQUEST['twttr_url_twitter'] ) ) {
+		if ( isset ( $_REQUEST['twttr_position'] ) && isset ( $_REQUEST['twttr_url_twitter'] ) && check_admin_referer( plugin_basename(__FILE__), 'twttr_nonce_name' ) ) {
 			$twttr_options_array['twttr_url_twitter'] = $_REQUEST['twttr_url_twitter'];
 			$twttr_options_array['twttr_position'] = $_REQUEST['twttr_position'];
 			update_option ( "twttr_options_array", $twttr_options_array );
 			$message = __( "Options saved.", 'twitter' );
 		} ?>
@@ -187,10 +187,11 @@ if (!function_exists ( 'twttr_settings_page' ) ) {
 						<td colspan="2">
 							<input type="submit" class="button-primary" value="<?php _e( 'Save Changes' ) ?>" />
 						</td>
 					</tr>
 					</table>
+					<?php wp_nonce_field( plugin_basename(__FILE__), 'twttr_nonce_name' ); ?>
 				</form>
 			</div>
 		</div>
 	<?php
 	}		

Vulnerable code: "POT-Creation-Date: 2012-07-12 11:43+0300\n"
"PO-Revision-Date: 2012-07-12 11:43+0300\n"
#: twitter.php:244
#: twitter.php:253
#: twitter.php:223
#: twitter.php:254
#: twitter.php:255
"POT-Creation-Date: 2012-07-12 11:43+0300\n"
"PO-Revision-Date: 2012-07-12 11:43+0300\n"
#: twitter.php:244
#: twitter.php:253
#: twitter.php:223
#: twitter.php:254
#: twitter.php:255
Stable tag: 2.14
Version: 2.14
		if ( isset ( $_REQUEST['twttr_position'] ) && isset ( $_REQUEST['twttr_url_twitter'] ) ) {
Fixed code: msgid ""
msgstr ""
"Project-Id-Version: twitter\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2012-07-24 20:03+0300\n"
"PO-Revision-Date: 2012-07-24 20:03+0300\n"
"Last-Translator: zos <zos@bestwebsoft.com>\n"
"Language-Team: Albayan Design Hani Aladoli <info@albayan-design.com>\n"
"Language: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Poedit-KeywordsList: __;_e\n"
"X-Poedit-Basepath: ..\n"
"X-Poedit-Language: arabic\n"
"X-Poedit-Country: libya\n"
"X-Poedit-SourceCharset: utf-8\n"
"X-Poedit-SearchPath-0: .\n"

#: twitter.php:80
msgid "Activated plugins"
msgstr "الاضافات المفعلة "

#: twitter.php:82
#: twitter.php:90
#: twitter.php:98
msgid "Read more"
msgstr "اقراء المزيد"

#: twitter.php:82
#: twitter.php:245
#: twitter.php:254
msgid "Settings"
msgstr "الاعدادت "

#: twitter.php:88
msgid "Installed plugins"
msgstr "الاضافات المركبة"

#: twitter.php:96
msgid "Recommended plugins"
msgstr "اضافات موصي بها"

#: twitter.php:98
msgid "Download"
msgstr "تحميل"

#: twitter.php:98
#, php-format
msgid "Install %s"
msgstr "تركيب %s"

#: twitter.php:98
msgid "Install now from wordpress.org"
msgstr "نزلها الان من wordpress.org"

#: twitter.php:100
msgid "If you have any questions, please contact us via plugin@bestwebsoft.com or fill in our contact form on our site"
msgstr "اذا كان لديك اي استفسار او سؤال الرجاء الاتصال بنا عبر بريدنا الالكتروني :  contact us via plugin@bestwebsoft.com  , او المراسلة الفورية من واجهة الاتصال بنا علي موقعنا الخاص"

#: twitter.php:131
#: twitter.php:153
msgid "Twitter Options"
msgstr "خيارات التويتر"

#: twitter.php:131
msgid "Twitter"
msgstr "التويتر"

#: twitter.php:149
msgid "Options saved."
msgstr "تم حفظ الخيارات"

#: twitter.php:160
msgid "Settings for the button \"Follow Me\":"
msgstr "اعدادات زر \"Follow Me\":"

#: twitter.php:164
msgid "Enter your username:"
msgstr "اكتب اسم المستخدم :"

#: twitter.php:168
msgid "If you do not have Twitter account yet you need to create it using this link"
msgstr "اذا كنت لا تملك حساب علي التويتر يمكنك انشاء حساب جديد عبر هذه الرابط"

#: twitter.php:169
msgid "Put a shortcode [follow_me] on necessary page or post to use \"Follow Me\" button."
msgstr "ضع هذه الكود [follow_me]في الصفحات المطلوبه او في المواضيع  \"Follow Me\" زر."

#: twitter.php:170
msgid "If you would like to utilize this button in another place, please put strings below into the template source code"
msgstr "إذا كنت ترغب في الاستفادة من هذا الزر في مكان آخر، يرجي وضع الاعدادات في الاسفل ( مربع الكود )"

#: twitter.php:174
msgid "Settings for the button \"Twitter\":"
msgstr "اعدادات لهذه الزر  \"Twitter\":"

#: twitter.php:178
msgid "Choose a position for an icon \"Twitter\":"
msgstr "اختار مكان لوضع ايقونه  \"Twitter\":"

#: twitter.php:181
msgid "Top position"
msgstr "في الاعلي "

#: twitter.php:182
msgid "Bottom position"
msgstr "في الاسفل"

#: twitter.php:183
msgid "When clicking this sign a user adds to their twitter page article that they liked along with a link to it."
msgstr "عند النقر على هذا العلامة على أن يضيف المستخدم إلى صفحة مقالتهم في تويتر مع روابطها"

#: twitter.php:188
msgid "Save Changes"
msgstr "حفظ الاعدادت"

#: twitter.php:224
msgid "Click here if you liked this article."
msgstr "اضغط هنا اذا اعجبك هذه المقال"

#: twitter.php:255
msgid "FAQ"
msgstr "أسئلة وأجوبة"

#: twitter.php:256
msgid "Support"
msgstr "الدعم"

#~ msgid "BWS Plugins"
#~ msgstr "Плагины BWS"
#~ msgid "Install Now"
#~ msgstr "Установить сейчас"
#~ msgid "Twitter options"
#~ msgstr "Опции Twitter"

"POT-Creation-Date: 2012-07-24 20:03+0300\n"
"PO-Revision-Date: 2012-07-24 20:03+0300\n"
#: twitter.php:245
#: twitter.php:254
#: twitter.php:224
#: twitter.php:255
#: twitter.php:256
"POT-Creation-Date: 2012-07-24 20:03+0300\n"
"PO-Revision-Date: 2012-07-24 20:03+0300\n"
#: twitter.php:245
#: twitter.php:254
#: twitter.php:224
#: twitter.php:255
#: twitter.php:256
Stable tag: 2.15
* Arabic (ar_AR) (thanks to Albayan Design Hani Aladoli)
= V2.15 - 24.07.2012 =
* NEW : Arabic language file is added to the plugin.
* Bugfix : Cross Site Request Forgery bug was fixed.

= V2.15 =
Arabic language file is added to the plugin. Cross Site Request Forgery bug was fixed.

Version: 2.15
		if ( isset ( $_REQUEST['twttr_position'] ) && isset ( $_REQUEST['twttr_url_twitter'] ) && check_admin_referer( plugin_basename(__FILE__), 'twttr_nonce_name' ) ) {
					<?php wp_nonce_field( plugin_basename(__FILE__), 'twttr_nonce_name' ); ?>