CVE-2024-4086: CM Tooltip Glossary – Powerful Glossary Plugin <= 4.2.11 - Cross-Site Request Forgery
The CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.11. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's settings or reset them via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/CM Tooltip Glossary – Powerful Glossary Pluginto a version that resolves this vulnerability.Fixed in 4.2.11 - Configuration
Ensure the plugin’s settings-save/reset endpoints validate nonces correctly to prevent CSRF (vulnerable due to missing or incorrect nonce validation up to and including 4.2.11).
WordPress plugin: CM Tooltip Glossary – Powerful Glossary Plugin nonce validation when saving settings = Correct nonce validation required (prevent missing/incorrect nonce) - Compensating control
Protect the WordPress admin actions used to save/reset the plugin settings by restricting exposure (e.g., ensure administrators only trigger settings changes intentionally, and apply network/access controls so attackers can’t rely on CSRF via tricked clicks).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4086?
CVE-2024-4086 is classified as a moderate severity vulnerability due to the potential for Cross-Site Request Forgery exploits.
How do I fix CVE-2024-4086?
To fix CVE-2024-4086, update the CM Tooltip Glossary plugin to version 4.2.12 or later.
What effect does CVE-2024-4086 have on my WordPress site?
CVE-2024-4086 allows unauthenticated attackers to potentially change settings within the CM Tooltip Glossary plugin.
Which versions of the CM Tooltip Glossary plugin are affected by CVE-2024-4086?
CVE-2024-4086 affects all versions of the CM Tooltip Glossary plugin up to and including 4.2.11.
Is user authentication required to exploit CVE-2024-4086?
No, CVE-2024-4086 can be exploited by unauthenticated attackers, making it a critical concern for users.