WPC Order Notes Vulnerable to Cross-Site Request Forgery

CVE-2024-12004

What is CVE-2024-12004?

The WPC Order Notes for WooCommerce plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability due to inadequate nonce validation in the ajax_update_order_note() function. This flaw allows unauthenticated attackers to exploit the system, potentially injecting malicious web scripts. The attack can occur if a site administrator is misled into clicking a malicious link, enabling the attacker to perform unwanted actions within the application without the administrator's consent. Ensuring proper nonce validation and implementing security measures can help mitigate risks associated with this vulnerability.

References