Cross-Site Request Forgery Vulnerability in Automattic Newspack Newsletters

CVE-2024-37242

Summary

The Automattic Newspack Newsletters plugin is affected by a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. This vulnerability can be exploited when an affected user is tricked into clicking a malicious link, leading to unintended behavior within the application. The flaw poses significant risks as it can result in changes to user settings or the execution of commands without the user's consent. Users of Newspack Newsletters are urged to review their plugins and apply necessary updates to mitigate potential security threats.

References