CVE-2024-1162: Orbit Fox by ThemeIsle <= 2.10.29 - Cross-Site Request Forgery
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. This is due to missing or incorrect nonce validation on the registerreference() function. This makes it possible for unauthenticated attackers to update the connected API keys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Orbit Fox by ThemeIsleto a version that resolves this vulnerability.Fixed in 2.10.29 - Compensating control
Protect the WordPress admin/session from CSRF by ensuring admin actions that update connected API keys cannot be triggered via forged requests (e.g., require CSRF/nonces to be validated for register_reference() and do not permit such endpoints to be invoked without proper nonce checking).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1162?
CVE-2024-1162 is a medium severity vulnerability due to its ability to allow unauthenticated attackers to exploit Cross-Site Request Forgery.
How do I fix CVE-2024-1162?
To fix CVE-2024-1162, update the Orbit Fox by ThemeIsle plugin to version 2.10.30 or later.
Which versions of Orbit Fox are affected by CVE-2024-1162?
CVE-2024-1162 affects all versions of Orbit Fox by ThemeIsle up to and including 2.10.29.
What type of vulnerability is CVE-2024-1162?
CVE-2024-1162 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
Can unauthenticated users exploit CVE-2024-1162?
Yes, unauthenticated users can exploit CVE-2024-1162 due to the lack of proper nonce validation.