Cross-Site Request Forgery Vulnerability in Automate Hub Free by Sperse.IO

CVE-2024-13683

Summary

The Automate Hub Free plugin by Sperse.IO for WordPress is susceptible to an exposure that allows Cross-Site Request Forgery (CSRF) attacks. Specifically, this vulnerability arises from inadequate nonce validation on the 'automate_hub' settings page. As a result, unauthenticated attackers could exploit this flaw to manipulate the activation status of the plugin by deceiving a site administrator into executing a malicious request, such as clicking on a compromised link. This behavior compromises the integrity of the plugin and could lead to unauthorized changes within the site.

References