CVE-2024-3947: WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_settings
The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodosettings() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3947?
CVE-2024-3947 is considered a high severity vulnerability due to its potential for exploitation by unauthenticated attackers.
How do I fix CVE-2024-3947?
To fix CVE-2024-3947, update the WP To Do plugin to version 1.3.1 or later, which includes proper nonce validation.
What type of vulnerability is CVE-2024-3947?
CVE-2024-3947 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP To Do plugin.
Who is affected by CVE-2024-3947?
Any user of the WP To Do plugin version up to and including 1.3.0 is affected by CVE-2024-3947.
Can CVE-2024-3947 be exploited remotely?
Yes, CVE-2024-3947 can be exploited remotely by unauthenticated attackers due to the lack of proper nonce validation.