Cross-Site Request Forgery Vulnerability in Peter’s Custom Anti-Spam Plugin for WordPress
CVE-2024-12554

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Peter’s Custom Anti-spam
Vendor
CVE Published:
18 December 2024

What is CVE-2024-12554?

CVE-2024-12554 identifies a critical Cross-Site Request Forgery (CSRF) vulnerability in the Peter's Custom Anti-Spam plugin for WordPress. This vulnerability affects all versions up to and including 3.2.3, arising from a lack of nonce validation in the cas_register_post() function. As a result, unauthenticated attackers can execute malicious requests to blacklist emails by tricking a site administrator into interacting with a harmful link. This highlights the importance of implementing robust security measures to verify user actions and protect against CSRF attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Peter’s Custom Anti-Spam * <= 3.2.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/peters-custom-...
https://wordpress.org/plugins/peters-custom-anti-spam-ima...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.