CVE-2024-3163: Easy Property Listings < 3.5.4 - Arbitrary Contact Deletion via CSRF
The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3163?
CVE-2024-3163 is considered a high severity vulnerability due to its potential for CSRF attacks that can lead to unauthorized actions by logged-in admins.
How do I fix CVE-2024-3163?
To fix CVE-2024-3163, update the Easy Property Listings WordPress plugin to version 3.5.4 or later, which includes the necessary CSRF protections.
Who is affected by CVE-2024-3163?
CVE-2024-3163 affects users of the Easy Property Listings WordPress plugin before version 3.5.4.
Is CVE-2024-3163 a remote attack vulnerability?
CVE-2024-3163 requires authentication, meaning that only logged-in admins can be exploited via a CSRF attack.
What actions can an attacker perform using CVE-2024-3163?
An attacker could leverage CVE-2024-3163 to delete contact entries in bulk without the admin’s consent.