Cross-Site Request Forgery Vulnerability Affects 404 Error Monitor Plugin

CVE-2024-11118

What is CVE-2024-11118?

The 404 Error Monitor plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation in the updatePluginSettings() function. This flaw enables unauthenticated attackers to manipulate plugin settings and remove error logs by crafting a malicious request. The attack requires the victim to unknowingly execute an action, such as clicking a deceptive link, which compromises the integrity of the WordPress site.

References