Cross-Site Request Forgery (CSRF) vulnerability in Cooked plugin for WordPress
CVE-2024-39680

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Cooked
Vendor
CVE Published:
18 July 2024

Summary

The Cooked plugin for WordPress is prone to a Cross-Site Request Forgery (CSRF) vulnerability due to inadequate nonce validation on the AJAX action handler. This flaw may allow attackers to manipulate users into executing unintended actions while logged in, posing a risk to the security of the site. Users are strongly recommended to upgrade to version 1.8.0, where this issue has been addressed. Unfortunately, there are no known workarounds for users unable to update immediately.

Affected Version(s)

Cooked < 1.8.0

References

https://github.com/XjSv/Cooked/security/advisories/GHSA-f...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.