Cross-Site Request Forgery in FoodBakery WordPress Theme by FoodBakery

CVE-2024-13933

What is CVE-2024-13933?

The FoodBakery WordPress Theme is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation in several functions, including foodbakery_var_backup_file_delete and theme_option_save. This flaw allows unauthenticated attackers to exploit the vulnerability by tricking a site administrator into executing forged requests, which can result in unauthorized file deletions, updates to theme options, and manipulations of widget settings. All versions up to and including 4.7 are affected, making it essential for users to patch this security loophole.

References