CVE-2024-12414: Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery
The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the settingpage() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12414?
CVE-2024-12414 is rated as a medium severity vulnerability due to its potential to allow unauthenticated attackers to modify settings.
How do I fix CVE-2024-12414?
To remediate CVE-2024-12414, update the Themify Store Locator plugin to version 1.1.10 or later, which includes proper nonce validation.
Who is affected by CVE-2024-12414?
CVE-2024-12414 affects all versions of the Themify Store Locator plugin up to and including version 1.1.9.
What kind of attack can exploit CVE-2024-12414?
CVE-2024-12414 can be exploited via Cross-Site Request Forgery, allowing attackers to make unauthorized changes.
Is there a patch available for CVE-2024-12414?
Yes, a patch is available in version 1.1.10 of the Themify Store Locator plugin, which resolves the nonce validation issue.