Cross-Site Request Forgery Vulnerability in WP Legal Pages Plugin for WordPress

CVE-2024-12636

Summary

The WP Legal Pages plugin for WordPress is affected by a Cross-Site Request Forgery vulnerability that impacts all versions up to and including 3.2.6. The issue arises from a lack of adequate nonce validation in the 'create_popup_delete_process' function. This flaw allows unauthenticated attackers to exploit this vulnerability by deceiving site administrators into triggering a malicious link, thereby facilitating the unauthorized deletion of popups. Website administrators using this plugin should implement necessary updates and apply security best practices to safeguard their sites from potential exploitations.

References