CVE-2024-12385: WP Abstracts <= 2.7.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing nonce validation on the wpabstractsloadstatus() and wpabstractsdeleteabstracts() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12385?
CVE-2024-12385 is classified as a Cross-Site Request Forgery vulnerability with a medium severity due to potential unauthorized actions.
How do I fix CVE-2024-12385?
To fix CVE-2024-12385, update the WP Abstracts plugin to version 2.7.3 or later, which includes nonce validation.
What versions of WP Abstracts are affected by CVE-2024-12385?
CVE-2024-12385 affects all versions of the WP Abstracts plugin up to and including version 2.7.2.
What functions are vulnerable in CVE-2024-12385?
The functions wpabstracts_load_status() and wpabstracts_delete_abstracts() are vulnerable in CVE-2024-12385 due to missing nonce validation.
Is my WordPress site at risk if I use WP Abstracts?
If you are using WP Abstracts version 2.7.2 or earlier, your site is at risk for Cross-Site Request Forgery attacks as highlighted by CVE-2024-12385.