Cross-Site Request Forgery Vulnerability in WP Abstracts Plugin by WordPress
CVE-2024-12385

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
WP Abstracts
Vendor
CVE Published:
18 January 2025

Summary

The WP Abstracts plugin for WordPress is affected by a Cross-Site Request Forgery due to inadequate nonce validation in the wpabstracts_load_status() and wpabstracts_delete_abstracts() functions. This vulnerability allows unauthenticated attackers to execute malicious web scripts by crafting a forged request, potentially tricking site administrators into performing unintended actions. It is crucial for users of the affected versions to upgrade to mitigate the risk of exploitation.

Affected Version(s)

WP Abstracts * <= 2.7.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-abstracts-m...
https://plugins.trac.wordpress.org/browser/wp-abstracts-m...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dale Mavers
.