Cross-Site Request Forgery Vulnerability in Stream Plugin for WordPress
CVE-2024-7423

8.8HIGH

Key Information:

Vendor

Wordpress
Status
Stream
Vendor
CVE Published:
13 September 2024

What is CVE-2024-7423?

The Stream plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation within its network_options_action() function. This vulnerability affects all versions up to and including 4.0.1. As a result, unauthenticated attackers could exploit this issue to send forged requests, tricking site administrators into performing unintended actions. Such actions may allow attackers to alter arbitrary options within the plugin, potentially leading to Denial of Service (DoS) attacks or privilege escalation. Proper validation processes are essential to mitigate this risk and safeguard against unauthorized access.

Affected Version(s)

Stream * <= 4.0.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/stream/tags/4....
https://plugins.trac.wordpress.org/changeset/3139815/stre...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dale Mavers
.