CVE-2024-10892: Cost Calculator Builder < 3.2.43 - Settings update via CSRF
The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10892?
The severity of CVE-2024-10892 is classified as a medium risk due to the potential for CSRF attacks affecting authenticated users.
How do I fix CVE-2024-10892?
To fix CVE-2024-10892, update the Cost Calculator Builder plugin to version 3.2.43 or later.
What actions are vulnerable in CVE-2024-10892?
CVE-2024-10892 affects certain AJAX actions within the Cost Calculator Builder plugin that lack CSRF protection.
Who is affected by CVE-2024-10892?
Users of the Cost Calculator Builder WordPress plugin before version 3.2.43 are affected by CVE-2024-10892.
Can CVE-2024-10892 lead to account compromise?
Yes, CVE-2024-10892 can lead to unauthorized actions being performed by attackers if they exploit CSRF vulnerabilities during active user sessions.