Cross-Site Request Forgery (CSRF) Vulnerability in Cooked Plugin for WordPress
CVE-2024-39679

8.8HIGH

Key Information:

Vendor

Wordpress
Status
Cooked
Vendor
CVE Published:
18 July 2024

What is CVE-2024-39679?

The Cooked plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) attack, impacting versions up to and including 1.7.15.4. This vulnerability arises from inadequate nonce validation on the AJAX action handler, which could permit an attacker to manipulate authenticated users into unintended actions. Users are strongly urged to upgrade to version 1.8.0 to remediate this issue, as no workarounds are available to mitigate the risk.

Affected Version(s)

Cooked < 1.8.0

References

https://github.com/XjSv/Cooked/security/advisories/GHSA-2...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.