Cross-Site Request Forgery Vulnerability in WordPress Crypto Plugin

CVE-2024-9990

Summary

The Crypto plugin for WordPress contains a security weakness that exposes it to Cross-Site Request Forgery (CSRF) attacks in all versions 2.15 and below. This vulnerability arises from insufficient nonce validation in the 'crypto_connect_ajax_process::check' function, enabling attackers to exploit the flaw. By tricking a site administrator into executing a crafted action, an unauthenticated attacker could potentially gain access to user accounts, including administrative privileges, through a forged request. Securing your WordPress installation and ensuring all plugins are up to date is critical to mitigate this risk.

References