CVE-2024-7420: Insert PHP Code Snippet <= 1.3.6 - Cross-Site Request Forgery to Code Snippet Activate/Deactivate/Deletion
The Insert PHP Code Snippet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6. This is due to missing or incorrect nonce validation in the /admin/snippets.php file. This makes it possible for unauthenticated attackers to activate/deactivate and delete code snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-43275 appears to be a duplicate of this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7420?
CVE-2024-7420 is considered a medium severity vulnerability due to its potential for Cross-Site Request Forgery attacks.
How do I fix CVE-2024-7420?
To mitigate CVE-2024-7420, update the Insert PHP Code Snippet plugin to version 1.3.7 or later.
Who is affected by CVE-2024-7420?
All versions of the Insert PHP Code Snippet plugin prior to 1.3.7 are affected by CVE-2024-7420.
What type of vulnerability is CVE-2024-7420?
CVE-2024-7420 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
When was CVE-2024-7420 disclosed?
CVE-2024-7420 was disclosed on October 15, 2024.