Cross-Site Request Forgery Vulnerability in Ultimate Classified Listings Plugin for WordPress
CVE-2024-13753
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 February 2025
What is CVE-2024-13753?
The Ultimate Classified Listings plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation in the update_profile function. This vulnerability allows unauthenticated attackers to send forged requests capable of altering a user’s email address. If successfully executed, this can lead to account takeover when users are misled into interacting with malicious links.
Affected Version(s)
Ultimate Classified Listings * <= 1.4