Cross-Site Request Forgery Vulnerability in WP Legal Pages Plugin for WordPress
CVE-2024-12636

4.3MEDIUM

Key Information:

Vendor

Wordpress
Status
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
Vendor
CVE Published:
25 December 2024

What is CVE-2024-12636?

The WP Legal Pages plugin for WordPress is affected by a Cross-Site Request Forgery vulnerability that impacts all versions up to and including 3.2.6. The issue arises from a lack of adequate nonce validation in the 'create_popup_delete_process' function. This flaw allows unauthenticated attackers to exploit this vulnerability by deceiving site administrators into triggering a malicious link, thereby facilitating the unauthorized deletion of popups. Website administrators using this plugin should implement necessary updates and apply security best practices to safeguard their sites from potential exploitations.

Affected Version(s)

Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages * <= 3.2.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
.