CVE-2024-3471: Button Generator < 3.0 - Button Deletion via CSRF
Published May 2, 2024
·Updated
The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin delete buttons via a CSRF attack
Affected Software
2 affected components
WordPress Button Generator<3.0
Wow-Company Button Generator WordPress<3.0
Event History
May 2, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-3471?
CVE-2024-3471 has a medium severity level due to the potential for unauthorized deletion of buttons via a CSRF attack.
2
How do I fix CVE-2024-3471?
To fix CVE-2024-3471, update the WordPress Button Generator plugin to version 3.0 or later.
3
Who is affected by CVE-2024-3471?
All users of the WordPress Button Generator plugin versions before 3.0 are affected by CVE-2024-3471.
4
What type of attack does CVE-2024-3471 enable?
CVE-2024-3471 enables a Cross-Site Request Forgery (CSRF) attack that can lead to unauthorized actions by an admin.
5
What are the consequences of exploiting CVE-2024-3471?
Exploiting CVE-2024-3471 can result in the deletion of buttons by an unauthorized attacker with access to a logged-in admin session.