CVE-2024-0203: CSRF
The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing nonce validation in the 'digitssavesettings' function. This makes it possible for unauthenticated attackers to modify the default role of registered users to elevate user privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0203?
CVE-2024-0203 has a medium severity rating due to its potential impact on user roles in a WordPress site.
How do I fix CVE-2024-0203?
To fix CVE-2024-0203, update the Digits plugin to version 8.4.2 or later, which includes nonce validation improvements.
Who is affected by CVE-2024-0203?
CVE-2024-0203 affects users of the Digits plugin for WordPress, specifically versions up to and including 8.4.1.
What type of attack does CVE-2024-0203 allow?
CVE-2024-0203 allows unauthenticated attackers to execute Cross-Site Request Forgery attacks, potentially altering user roles.
When was CVE-2024-0203 disclosed?
CVE-2024-0203 was disclosed in 2024, highlighting a significant security vulnerability in the Digits plugin.