CVE-2024-13753: Ultimate Classified Listings <= 1.5 - Cross-Site Request Forgery to Account Takeover
The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the updateprofile function. This makes it possible for unauthenticated attackers to modify victim's email via a forged request, which might lead to account takeover, granted they can trick a user into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13753?
CVE-2024-13753 is a medium severity vulnerability due to its potential for Cross-Site Request Forgery in the Ultimate Classified Listings plugin.
How do I fix CVE-2024-13753?
To fix CVE-2024-13753, update the Ultimate Classified Listings plugin to version 1.5 or later, which includes proper nonce validation.
Who is affected by CVE-2024-13753?
All users of the Ultimate Classified Listings plugin for WordPress up to and including version 1.4 are affected by CVE-2024-13753.
What type of vulnerability is CVE-2024-13753?
CVE-2024-13753 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
Is authentication required to exploit CVE-2024-13753?
No, unauthenticated attackers can potentially exploit CVE-2024-13753 due to the lack of proper nonce validation.