CVE-2024-3943: WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_addcomment
The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodoaddcomment function. This makes it possible for unauthenticated attackers to add comments to to do items via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3943?
CVE-2024-3943 is a medium severity vulnerability due to its potential for cross-site request forgery in the WP To Do plugin.
How do I fix CVE-2024-3943?
To fix CVE-2024-3943, update the WP To Do plugin to version 1.3.1 or later which addresses the nonce validation issue.
Who is affected by CVE-2024-3943?
All users of the WP To Do plugin for WordPress running versions up to and including 1.3.0 are affected by CVE-2024-3943.
What type of vulnerability is CVE-2024-3943?
CVE-2024-3943 is a Cross-Site Request Forgery (CSRF) vulnerability.
Can an attacker exploit CVE-2024-3943 without authentication?
Yes, an unauthenticated attacker can exploit CVE-2024-3943 to add comments through CSRF.