CVE-2024-3481: Counter Box < 1.2.4 - Counter Deletion via CSRF
Published May 2, 2024
·Updated
The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such deleting counters via CSRF attacks
Affected Software
2 affected components
Wow-Company Counter Box WordPress<1.2.4
Counter Box Counter Box<1.2.4
Event History
May 2, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-3481?
CVE-2024-3481 has a moderate severity due to the potential for unauthorized actions by logged in admins via CSRF attacks.
2
How do I fix CVE-2024-3481?
To fix CVE-2024-3481, update the Counter Box WordPress plugin to version 1.2.4 or later.
3
What actions can attackers perform due to CVE-2024-3481?
Attackers can exploit CVE-2024-3481 to make logged in admins perform unwanted actions, such as deleting counters.
4
Who is affected by CVE-2024-3481?
CVE-2024-3481 affects users of the Counter Box WordPress plugin versions before 1.2.4.
5
What is the root cause of CVE-2024-3481?
The root cause of CVE-2024-3481 is the lack of CSRF checks in some bulk actions within the Counter Box plugin.