CVE-2024-0892: Schema App Structured Data <= 2.2.0 - Cross-Site Request Forgery
The Schema App Structured Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the MarkUpdate function. This makes it possible for unauthenticated attackers to update and delete post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0892?
CVE-2024-0892 is considered a medium severity vulnerability due to its potential for allowing unauthenticated attackers to perform unauthorized actions.
How do I fix CVE-2024-0892?
To fix CVE-2024-0892, update the Schema App Structured Data plugin to version 2.2.1 or later.
What type of attack does CVE-2024-0892 enable?
CVE-2024-0892 enables Cross-Site Request Forgery (CSRF) attacks due to inadequate nonce validation.
Which versions of the Schema App Structured Data plugin are affected by CVE-2024-0892?
All versions of the Schema App Structured Data plugin up to and including 2.2.0 are affected by CVE-2024-0892.
Is authentication required to exploit CVE-2024-0892?
No, CVE-2024-0892 can be exploited by unauthenticated attackers.