Cross-Site Request Forgery Vulnerability in SMS for WooCommerce Plugin

CVE-2024-12220

Summary

CVE-2024-12220 identifies a critical Cross-Site Request Forgery (CSRF) vulnerability in the SMS for WooCommerce plugin for WordPress. This security flaw, present in all versions up to and including 2.8.1, stems from inadequate nonce validation in certain functions. As a result, unauthenticated attackers can exploit this vulnerability by crafting forged requests. If a site administrator inadvertently clicks a malicious link, the attacker could execute harmful actions on behalf of the administrator, potentially leading to severe security breaches. It is essential for users of this plugin to update to a patched version immediately to safeguard their WordPress installations from attacks.

References