Insert PHP Code Snippet vulnerable to CSRF
CVE-2024-43275

8.8HIGH

Key Information:

Vendor
WordPress
Status
Insert PHP Code Snippet
Vendor
CVE Published:
15 August 2024

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Insert PHP Code Snippet plugin developed by xyzscripts, affecting all versions up to 1.3.6. This security flaw allows an attacker to trick a logged-in user into executing unwanted actions on a web application, potentially leading to unauthorized changes and manipulation of user settings or data. Users of the plugin are advised to implement mitigation measures or upgrade to a patched version to protect their applications from such attacks.

Affected Version(s)

Insert PHP Code Snippet <= 1.3.6

References

https://patchstack.com/database/vulnerability/insert-php-...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.