CVE-2024-3642: Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF
Published May 16, 2024
·Updated
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack
Affected Software
2 affected components
WordPress Newsletter Popup<=1.2
Mndpsingh287 Newsletter Popup Wordpress<=1.2
Event History
May 16, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-3642?
CVE-2024-3642 is considered a high severity vulnerability due to its potential for CSRF attacks that can impact admin users.
2
How do I fix CVE-2024-3642?
To fix CVE-2024-3642, update the WordPress Newsletter Popup plugin to a version beyond 1.2 that implements CSRF protection.
3
What type of attack can exploit CVE-2024-3642?
CVE-2024-3642 can be exploited via Cross-Site Request Forgery (CSRF) attacks targeting logged in admin users.
4
Which versions of the Newsletter Popup plugin are affected by CVE-2024-3642?
CVE-2024-3642 affects the Newsletter Popup plugin versions up to and including 1.2.
5
Who is at risk with CVE-2024-3642?
Administrators using the vulnerable version of the Newsletter Popup WordPress plugin are at risk of CSRF attacks.