CVE-2024-5287: WP Affiliate Platform < 6.5.1 - Profile Update via CSRF
The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in user change them via a CSRF attack
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-affiliate-platformto a version that resolves this vulnerability.Fixed in 6.5.1 - Compensating control
Protect the WordPress admin endpoints used for the WP Affiliate Platform profile/settings update against CSRF (e.g., ensure requests require valid CSRF tokens and reject missing/invalid tokens).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5287?
CVE-2024-5287 has a moderate severity level due to the potential for a CSRF attack that can alter user settings.
How do I fix CVE-2024-5287?
To fix CVE-2024-5287, update the wp-affiliate-platform WordPress plugin to version 6.5.1 or later.
What type of attack is associated with CVE-2024-5287?
CVE-2024-5287 is associated with Cross-Site Request Forgery (CSRF) attacks.
Who is affected by CVE-2024-5287?
Users of the wp-affiliate-platform WordPress plugin versions prior to 6.5.1 are affected by CVE-2024-5287.
What does CVE-2024-5287 exploit?
CVE-2024-5287 exploits the lack of CSRF checks when updating plugin settings.