CVE-2024-8477: Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.87 - Cross-Site Request Forgery
The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.87. This is due to missing or incorrect nonce validation on the Init() function. This makes it possible for unauthenticated attackers to log out of a Brevo connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8477?
CVE-2024-8477 has been classified as a medium-severity vulnerability due to its potential for exploitation through Cross-Site Request Forgery.
How do I fix CVE-2024-8477?
To fix CVE-2024-8477, upgrade the Brevo (formerly Sendinblue) plugin for WordPress to version 3.1.88 or later.
What causes CVE-2024-8477?
CVE-2024-8477 is caused by missing or incorrect nonce validation in the Init() function of the Brevo plugin.
Which versions of the Brevo plugin are affected by CVE-2024-8477?
All versions of the Brevo plugin up to and including 3.1.87 are affected by CVE-2024-8477.
What type of vulnerability is CVE-2024-8477?
CVE-2024-8477 is a Cross-Site Request Forgery (CSRF) vulnerability that affects the Brevo WordPress plugin.