Code Injection Vulnerability in Podlove Podcast Publisher
CVE-2024-43984

8.8HIGH

Key Information:

Vendor

WordPress
Status
Podlove Podcast Publisher
Vendor
CVE Published:
31 October 2024

What is CVE-2024-43984?

A Cross-Site Request Forgery (CSRF) vulnerability found in Podlove Podcast Publisher allows malicious actors to perform code injection attacks. This security flaw affects versions of the Podlove Podcast Publisher up to and including 4.1.13, enabling unauthorized actions without proper user authentication. Websites utilizing this plugin may be at risk, allowing attackers to execute arbitrary code and potentially compromising the integrity of the system.

Affected Version(s)

Podlove Podcast Publisher <= 4.1.13

References

https://patchstack.com/database/vulnerability/podlove-pod...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

Credit

Muhammad Daffa (Patchstack Alliance)
.