Cross-Site Request Forgery in ViewMedica 9 Plugin for WordPress
CVE-2024-12170

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
Viewmedica 9
Vendor
CVE Published:
7 January 2025

What is CVE-2024-12170?

The ViewMedica 9 plugin for WordPress is prone to Cross-Site Request Forgery due to inadequate nonce validation on the 'Viewmedica-Admin' page. This vulnerability allows attackers to craft forgery requests, potentially leading to unauthorized execution of arbitrary SQL queries if an unsuspecting site administrator interacts with a malicious link. It is essential for users to review their plugin versions and apply necessary updates to mitigate this risk.

Affected Version(s)

ViewMedica 9 * <= 1.4.15

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/viewmedica/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguy Minh Tuan
.