Cross-Site Request Forgery Vulnerability in Rara Theme Travel Agency
CVE-2024-37451

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Travel Agency
Vendor
CVE Published:
2 January 2025

What is CVE-2024-37451?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Rara Theme Travel Agency, which could allow an attacker to perform unwanted actions on behalf of an authenticated user. This vulnerability is particularly concerning for website administrators as it can enable unauthorized access to sensitive operations, posing potential risks to both site security and user data. Affected versions include all versions up to 1.4.9. Proper mitigation measures, such as implementing anti-CSRF tokens, are recommended to safeguard user information and maintain the integrity of the web application.

Affected Version(s)

Travel Agency <= 1.4.9

References

https://patchstack.com/database/wordpress/theme/travel-ag...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dhabaleshwar Das (Patchstack Alliance)
.