Cross-Site Request Forgery Vulnerability in Binary MLM Woocommerce Plugin for WordPress

CVE-2024-12383

What is CVE-2024-12383?

The Binary MLM Woocommerce plugin for WordPress exposes a critical security flaw due to inadequate nonce validation in the 'bmw_display_pv_set_page' function. This vulnerability allows unauthenticated attackers to exploit insufficient input sanitization and output escaping of the 'product_points' parameter, potentially injecting arbitrary web scripts through a maliciously crafted request. The exploitation of this vulnerability could lead to unauthorized actions on behalf of legitimate users, particularly if an administrator is tricked into clicking a deceptive link.

References