Cross-Site Request Forgery Vulnerability in WordPress Stop Registration Spam Plugin
CVE-2024-12219

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Stop Registration Spam
Vendor
CVE Published:
17 December 2024

Summary

The Stop Registration Spam plugin for WordPress is critically vulnerable to Cross-Site Request Forgery (CSRF) attacks in all versions up to and including 1.23. The vulnerability arises from inadequate nonce validation, allowing unauthenticated attackers to exploit this weakness. By tricking site administrators into performing unintended actions through forged requests, an attacker can inject malicious web scripts into the site, potentially compromising its integrity and security.

Affected Version(s)

Stop Registration Spam * <= 1.23

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/stop-registration-spam/#dev...
https://plugins.trac.wordpress.org/changeset/3206562/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dale Mavers
.