CVE-2024-1719: Easy PayPal & Stripe Buy Now Button <= 1.8.3 & Contact Form 7 – PayPal & Stripe Add-on <= 2.1 - Cross-Site Request Forgery to Settings Update
The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecppstripeconnectcompletion' function. This makes it possible for unauthenticated attackers to modify the plugins settings and chance the stripe connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1719?
CVE-2024-1719 is considered a moderate severity vulnerability due to its nature of allowing cross-site request forgery.
How do I fix CVE-2024-1719?
To fix CVE-2024-1719, update the Easy PayPal & Stripe Buy Now Button plugin to version 1.8.4 or higher, and the Contact Form 7 – PayPal & Stripe Add-on to version 2.2 or higher.
Which versions are affected by CVE-2024-1719?
CVE-2024-1719 affects all versions of the Easy PayPal & Stripe Buy Now Button plugin up to and including 1.8.3, and all versions of the Contact Form 7 – PayPal & Stripe Add-on up to and including 2.1.
What type of attack does CVE-2024-1719 facilitate?
CVE-2024-1719 facilitates cross-site request forgery (CSRF) attacks due to insufficient nonce validation.
Is CVE-2024-1719 a plugin-specific vulnerability?
Yes, CVE-2024-1719 is specific to the Easy PayPal & Stripe Buy Now Button plugin and the Contact Form 7 – PayPal & Stripe Add-on for WordPress.