CVE-2024-7492: MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update
The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the networkoptionsaction() function. This makes it possible for unauthenticated attackers to update arbitrary options that can be leveraged for privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This is only exploitable on multisite instances.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7492?
CVE-2024-7492 is classified as a medium severity vulnerability due to its potential for exploitation via Cross-Site Request Forgery.
How do I fix CVE-2024-7492?
To fix CVE-2024-7492, update the MainWP Child Reports plugin to version 2.2 or later, which includes proper nonce validation.
Who is affected by CVE-2024-7492?
All users running MainWP Child Reports plugin versions up to and including 2.2 are affected by CVE-2024-7492.
What type of vulnerability is CVE-2024-7492?
CVE-2024-7492 is a Cross-Site Request Forgery vulnerability that allows unauthenticated attackers to perform unauthorized actions.
What is the impact of CVE-2024-7492?
The impact of CVE-2024-7492 includes the potential for attackers to exploit the vulnerability and affect the functionality of the WordPress site.