Cross-Site Request Forgery Vulnerability in Animated Rotating Words by Labib Ahmed
CVE-2024-38753

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Animated Rotating Words
Vendor
CVE Published:
2 January 2025

What is CVE-2024-38753?

The vulnerability manifests as a Cross-Site Request Forgery (CSRF) issue in the Animated Rotating Words plugin, which allows an attacker to trick a user into executing unwanted actions on a web application in which they are authenticated. This could lead to unauthorized changes or actions being taken without the user's consent. The vulnerability affects versions of the plugin from an unspecified initial release through version 5.6, making it critical for users to ensure their installations are updated to mitigate potential exploitation.

Affected Version(s)

Animated Rotating Words <= 5.6

References

https://patchstack.com/database/wordpress/plugin/css3-rot...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Majed Refaea (Patchstack Alliance)
.