Cross-Site Request Forgery Vulnerability in Binary MLM Woocommerce Plugin for WordPress
CVE-2024-12383
6.1MEDIUM
Summary
The Binary MLM Woocommerce plugin for WordPress exposes a critical security flaw due to inadequate nonce validation in the 'bmw_display_pv_set_page' function. This vulnerability allows unauthenticated attackers to exploit insufficient input sanitization and output escaping of the 'product_points' parameter, potentially injecting arbitrary web scripts through a maliciously crafted request. The exploitation of this vulnerability could lead to unauthorized actions on behalf of legitimate users, particularly if an administrator is tricked into clicking a deceptive link.
Affected Version(s)
Binary MLM Woocommerce * <= 2.0
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Colin Xu