Cross-Site Request Forgery Vulnerability in Reactflow Visitor Recording Plugin

CVE-2024-11975

What is CVE-2024-11975?

The Reactflow Visitor Recording and Heatmaps plugin for WordPress has a significant security flaw, identified as CVE-2024-11975, which is a Cross-Site Request Forgery (CSRF) vulnerability present in all versions up to and including 1.0.10. The vulnerability stems from inadequate nonce validation, specifically concerning the _wpnonce parameter. This oversight enables unauthenticated attackers to execute harmful web scripts through forged requests, particularly if they can deceive an administrator into clicking a malicious link. As such, it is critical for website administrators using this plugin to patch their installations to safeguard against potential exploitation.

References