CVE-2024-13774: Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name
The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'savetomultiplewishlist' function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13774?
CVE-2024-13774 is classified as a Cross-Site Request Forgery vulnerability, which can allow unauthorized actions to be performed on behalf of logged-in users.
How do I fix CVE-2024-13774?
To fix CVE-2024-13774, update the Wishlist for WooCommerce: Multi Wishlists Per Customer plugin to version 3.1.8 or later, which includes proper nonce validation.
Who is affected by CVE-2024-13774?
CVE-2024-13774 affects all users of the Wishlist for WooCommerce: Multi Wishlists Per Customer plugin on WordPress versions up to and including 3.1.7.
What actions can be exploited due to CVE-2024-13774?
Due to CVE-2024-13774, attackers could exploit the vulnerability to perform unauthorized changes to a user's wishlists.
Is there a workaround for CVE-2024-13774 before applying the update?
There is no recommended workaround for CVE-2024-13774; the best practice is to update the plugin as soon as possible.