CVE-2024-0379: Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the ctfautosavetokens function. This makes it possible for unauthenticated attackers to update the site's twitter API token and secret via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0379?
CVE-2024-0379 is considered a medium severity vulnerability due to its potential for unauthorized actions via Cross-Site Request Forgery.
How do I fix CVE-2024-0379?
To fix CVE-2024-0379, update the Custom Twitter Feeds plugin to version 2.2.2 or later where nonce validation has been correctly implemented.
What versions are affected by CVE-2024-0379?
CVE-2024-0379 affects all versions of the Custom Twitter Feeds plugin up to and including version 2.2.1.
What is the nature of the vulnerability in CVE-2024-0379?
CVE-2024-0379 is a Cross-Site Request Forgery vulnerability due to missing or incorrect nonce validation.
Who is primarily affected by CVE-2024-0379?
Users of the Custom Twitter Feeds plugin for WordPress, specifically those using versions up to 2.2.1, are primarily affected by CVE-2024-0379.