CVE-2024-0796: Active Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Cross-Site Request Forgery
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6.1. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0796?
CVE-2024-0796 is rated as a moderate severity vulnerability due to its potential impact on WooCommerce sites.
How do I fix CVE-2024-0796?
To fix CVE-2024-0796, update the Active Products Tables for WooCommerce plugin to version 1.0.6.2 or later.
What type of vulnerability is CVE-2024-0796?
CVE-2024-0796 is a Cross-Site Request Forgery vulnerability affecting the WooCommerce plugin.
Which versions of the WooCommerce plugin are affected by CVE-2024-0796?
All versions of the Active Products Tables for WooCommerce plugin up to and including 1.0.6.1 are affected by CVE-2024-0796.
Why is nonce validation important in relation to CVE-2024-0796?
Nonce validation is crucial as its absence or incorrect implementation allows attackers to perform unauthorized actions on behalf of users, leading to potential exploitation.