Cross-Site Request Forgery Vulnerability in WP Abstracts Plugin by WordPress
CVE-2024-12386

5.4MEDIUM

Key Information:

Vendor
WordPress
Status
WP Abstracts
Vendor
CVE Published:
12 February 2025

Summary

The WP Abstracts plugin for WordPress contains a Cross-Site Request Forgery vulnerability present in all versions up to and including 2.7.3. This flaw arises from the absence of nonce validation in several functions, allowing unauthenticated attackers to potentially delete user accounts. Attackers can exploit this vulnerability by tricking administrators into executing malicious actions, such as clicking on deceptive links.

Affected Version(s)

WP Abstracts * <= 2.7.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/wp-abstracts-manuscripts-ma...
https://plugins.trac.wordpress.org/changeset/3238664/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO
.