CVE-2024-13709: Linear <= 2.8.1 - Cross-Site Request Forgery to Cache Reset
The Linear plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on the 'linear-debug'. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13709?
CVE-2024-13709 is considered to be of high severity due to its potential impact allowing unauthorized access to sensitive operations through Cross-Site Request Forgery.
How do I fix CVE-2024-13709?
To fix CVE-2024-13709, update the Linear plugin for WordPress to version 2.8.2 or later, which includes proper nonce validation.
Who is affected by CVE-2024-13709?
All users of the Linear plugin for WordPress running version 2.8.1 or earlier are affected by CVE-2024-13709.
What are the potential consequences of CVE-2024-13709?
The potential consequences of CVE-2024-13709 include unauthorized cache resets, which could disrupt normal plugin functionality and lead to data inconsistencies.
Does CVE-2024-13709 affect authenticated users?
No, CVE-2024-13709 allows unauthenticated attackers to exploit the vulnerability, making it particularly concerning for site security.