Cross-Site Request Forgery Vulnerability in WPAdverts Classifieds Plugin by Greg Winiarski
CVE-2024-37238

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
WPadverts – Classifieds Plugin
Vendor
CVE Published:
2 January 2025

What is CVE-2024-37238?

A Cross-Site Request Forgery (CSRF) vulnerability in the WPAdverts – Classifieds Plugin developed by Greg Winiarski can potentially allow unauthorized actions to be performed on behalf of authenticated users. This weakness impacts all versions of the plugin up to 2.1.2, exposing users to various security risks. Attackers could exploit this flaw to affect user accounts and disrupt the normal operation of the plugin, creating an urgent need for users to update to the latest version or implement mitigation measures.

Affected Version(s)

WPAdverts – Classifieds Plugin <= 2.1.2

References

https://patchstack.com/database/wordpress/plugin/wpadvert...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Majed Refaea (Patchstack Alliance)
.