CVE-2024-1362: Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh
The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing or incorrect nonce validation on the cpshortcoderefresh() function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Colibri Page Builderto a version that resolves this vulnerability.Fixed in 1.0.253
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1362?
CVE-2024-1362 has a medium severity rating due to the risk of Cross-Site Request Forgery vulnerabilities.
How do I fix CVE-2024-1362?
To fix CVE-2024-1362, update the Colibri Page Builder plugin to version 1.0.260 or later which includes the necessary nonce validation.
Who is affected by CVE-2024-1362?
CVE-2024-1362 affects all users of the Colibri Page Builder plugin for WordPress versions up to and including 1.0.253.
What kind of attacks can exploit CVE-2024-1362?
CVE-2024-1362 can be exploited by unauthenticated attackers to execute unauthorized actions on behalf of a logged-in user.
Is CVE-2024-1362 specific to a particular WordPress version?
No, CVE-2024-1362 is not limited to a specific version of WordPress but applies to the Colibri Page Builder plugin in its vulnerable versions.