CVE-2024-3059: ENL Newsletter <= 1.0.1 - Campaign Deletion via CSRF
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3059?
The severity of CVE-2024-3059 is considered high due to the potential for attackers to exploit CSRF vulnerabilities to manipulate admin actions.
How do I fix CVE-2024-3059?
To fix CVE-2024-3059, update the ENL Newsletter WordPress plugin to the latest version that addresses the CSRF vulnerability.
Who is affected by CVE-2024-3059?
CVE-2024-3059 affects users of the ENL Newsletter WordPress plugin version 1.0.1 and below.
What type of attack is involved in CVE-2024-3059?
CVE-2024-3059 involves a Cross-Site Request Forgery (CSRF) attack that can enable unauthorized operations by exploiting a logged-in admin session.
What actions can attackers perform due to CVE-2024-3059?
Attackers exploiting CVE-2024-3059 could delete arbitrary Campaigns within the ENL Newsletter plugin without proper authorization.