Cross-Site Request Forgery Vulnerability in DSGVO All in One for WP Plugin by WordPress
CVE-2024-13356

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Dsgvo All In One For WP
Vendor
CVE Published:
4 February 2025

What is CVE-2024-13356?

The DSGVO All in One for WP plugin for WordPress is susceptible to a Cross-Site Request Forgery flaw due to inadequate nonce validation in the user_remove_form.php file. This vulnerability allows unauthenticated attackers to initiate an unauthorized action that could delete admin user accounts. An attacker could exploit this by tricking a site administrator into clicking a crafted link, leading to a potential compromise of site administration.

Affected Version(s)

DSGVO All in one for WP * <= 4.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/dsgvo-all-in-o...
https://plugins.trac.wordpress.org/changeset/3233492/dsgv...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khayal Farzaliyev
.