CVE-2024-1360: Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation
The Colibri WP theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.94. This is due to missing or incorrect nonce validation on the colibriwpinstallplugin() function. This makes it possible for unauthenticated attackers to install recommended plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
colibriwp theme (Colibri WP)to a version that resolves this vulnerability.Fixed in 1.0.94 - Compensating control
Mitigate CSRF exposure by preventing unauthenticated attackers from triggering plugin-install actions (e.g., ensure administrators do not follow forged links that could cause the vulnerable action to run).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1360?
CVE-2024-1360 is classified as a moderate severity vulnerability due to the potential for unauthorized plugin installations.
How do I fix CVE-2024-1360?
To fix CVE-2024-1360, update the Colibri WP theme to version 1.1.101 or later.
Who is affected by CVE-2024-1360?
Any user of the Colibri WP theme for WordPress up to and including version 1.0.94 is affected by CVE-2024-1360.
What type of vulnerability is CVE-2024-1360?
CVE-2024-1360 is a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce validation.
Can CVE-2024-1360 be exploited by unauthorized users?
Yes, CVE-2024-1360 can be exploited by unauthenticated attackers to install recommended plugins.