Cross-Site Request Forgery in wp-greet Plugin for WordPress

CVE-2024-13444

What is CVE-2024-13444?

The wp-greet plugin for WordPress exhibits a vulnerability to Cross-Site Request Forgery due to inadequate nonce validation in various functions. This flaw allows unauthenticated attackers to make unauthorized changes to settings if they can deceive an administrator into triggering a forged request, such as clicking on a malicious link. All versions of the plugin up to and including 6.2 are affected, highlighting the importance of proper validation mechanisms to protect against such exploits.

References