Cross-Site Request Forgery Vulnerability in ThePerfectWedding.nl Widget Plugin for WordPress
CVE-2024-12322
8.8HIGH
What is CVE-2024-12322?
ThePerfectWedding.nl Widget plugin for WordPress is susceptible to Cross-Site Request Forgery due to insufficient nonce validation in the 'update_option' function. This vulnerability allows unauthenticated attackers to exploit the weakness by tricking a site administrator into performing actions that trigger unauthorized updates to the 'tpwKey' option. As a result, malicious actors can potentially inject stored cross-site scripting through forged requests, compromising the site's integrity.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
ThePerfectWedding.nl Widget * <= 2.8
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Dale Mavers