Cross-Site Request Forgery Vulnerability in EnvíaloSimple Email Marketing Plugin

CVE-2024-2125

What is CVE-2024-2125?

The EnvíaloSimple Email Marketing y Newsletters plugin for WordPress experiences a Cross-Site Request Forgery vulnerability present in all versions up to and including 2.3. This vulnerability arises from improper nonce validation in the gallery_add function, enabling unauthenticated attackers to potentially exploit this flaw. By deceiving a site administrator into executing specific actions, such as clicking on a malicious link, attackers can leverage this security gap to upload malicious files, posing significant risks to the integrity and security of affected WordPress sites.

References