CVE-2024-3945: WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_manage()
The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodomanage() function. This makes it possible for unauthenticated attackers to add new todo items via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3945?
CVE-2024-3945 is considered a moderate severity vulnerability due to its ability to allow unauthenticated attackers to manipulate the application.
How do I fix CVE-2024-3945?
To fix CVE-2024-3945, update the WP To Do plugin to version 1.4.0 or later, where the nonce validation issue is resolved.
Who is affected by CVE-2024-3945?
CVE-2024-3945 affects all versions of the WP To Do plugin up to and including version 1.3.0.
What types of attacks can CVE-2024-3945 facilitate?
CVE-2024-3945 can facilitate Cross-Site Request Forgery (CSRF) attacks, allowing attackers to add unauthorized todo items.
What is the root cause of CVE-2024-3945?
The root cause of CVE-2024-3945 is the missing or incorrect nonce validation in the wptodo_manage() function.