How severe is CVE-2019-6703?

CVE-2019-6703 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-6703 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 26% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-6703?

CVE-2019-6703 affects Calmar-webmedia Total Donations. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-6703?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2019-6703 published?

CVE-2019-6703 was published on 2019-01-27 and last updated on 2026-06-17.

CVE-2019-6703

CVE-2019-6703 is a critical-severity vulnerability in Calmar-webmedia Total Donations with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 26% places it in the 98th percentile, indicating an elevated likelihood of exploitation.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 26% (98th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Calmar-webmedia Total Donations
Published: 2019-01-27
Last modified: 2026-06-17

Description

Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

Frequently asked questions

What is CVE-2019-6703?: Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
How severe is CVE-2019-6703?: CVE-2019-6703 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2019-6703 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 26% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-6703?: CVE-2019-6703 affects Calmar-webmedia Total Donations. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-6703?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2019-6703 published?: CVE-2019-6703 was published on 2019-01-27 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:calmar-webmedia:total_donations:*:*:*:*:*:wordpress:*:*