CVE-2024-2405: Float menu < 6.0.1 - Menu Deletion via CSRF
Published May 2, 2024
·Updated
The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack.
Affected Software
2 affected components
Float menu<6.0.1
Wow-Company Float menu WordPress<6.0.1
Event History
May 2, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-2405?
CVE-2024-2405 has a medium severity rating due to its potential for CSRF attacks affecting logged-in admins.
2
How do I fix CVE-2024-2405?
To fix CVE-2024-2405, update the Float Menu plugin to version 6.0.1 or later.
3
What type of vulnerability is CVE-2024-2405?
CVE-2024-2405 is a Cross-Site Request Forgery (CSRF) vulnerability.
4
Who is affected by CVE-2024-2405?
Users of the Float Menu WordPress plugin before version 6.0.1 are affected by CVE-2024-2405.
5
What could attackers achieve with CVE-2024-2405?
Attackers could exploit CVE-2024-2405 to delete arbitrary menus as logged-in admins via CSRF attacks.