← Back

CVE-2024-12386

nvd nist
Published: Feb 12, 2025Modified: Feb 20, 2025

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Exploitability: 2.8 / Impact: 2.5
Source: NVD

Description

The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due to missing nonce validation on multiple functions. This makes it possible for unauthenticated attackers to delete arbitrary accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected (1)

Kevonadonis
1 product
Wp Abstracts
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Wp Abstracts
Before 2.7.4

Related CWEs

CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (3)

Source: security@wordfence.com
Patch
Source: security@wordfence.com
ProductRelease Notes
Source: security@wordfence.com
Third Party Advisory

Timeline

No history available yet.