CVE-2019-6703

CVE-2019-6703 describes an incorrect access control vulnerability in the Calmar Webmedia Total Donations plugin for WordPress, affecting versions through 2.0.5. This critical flaw allows unauthenticated attackers to update arbitrary WordPress option values by sending requests to wp-admin/admin-ajax.php, specifically calling the miglaA_update_me action. The vulnerability has a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability, potentially leading to full site takeover by enabling new user registration and setting the default role to Administrator. While not listed on CISA's KEV catalog, there is evidence of active exploitation, as indicated by media coverage and the availability of Nuclei templates for detection, alongside notable community discussion.