Cross-Site Request Forgery Vulnerability in Subscriptions & Memberships for PayPal Plugin

CVE-2024-13560

What is CVE-2024-13560?

The Subscriptions & Memberships for PayPal plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation in its functions. This vulnerability enables unauthenticated attackers to initiate malicious requests that could result in the deletion of arbitrary posts, provided they can deceive an administrator into executing a malicious link. All versions up to and including 1.1.6 are affected.

References