Cross-Site Request Forgery Vulnerability Affects Brevo Plugin for WordPress

CVE-2024-8477

What is CVE-2024-8477?

The Brevo Newsletter, SMTP, Email marketing, and Subscribe forms plugin for WordPress contains a vulnerability that allows for Cross-Site Request Forgery (CSRF) due to inadequate nonce validation within the Init() function. This security flaw enables unauthenticated attackers to potentially force a logged-in site administrator to log out of a Brevo connection by tricking them into performing an unintended action, such as clicking on a malicious link. This vulnerability affects all plugin versions up to and including 3.1.87, emphasizing the need for website administrators using this plugin to ensure they are operating on the latest version and implementing additional security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References