CVE-2024-12280

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 73.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Marvinlabs WP Customer AreaUnknown WP Customer Area
Timeline
PublishedJan 27

Description

The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in to delete them via a CSRF attack

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5unknown/wp_customer_area8.2.4

🔴Vulnerability Details

2
GHSA
GHSA-f39m-g6qq-h3xv: The WP Customer Area WordPress plugin through 8↗2025-01-27
▶
CVEList
WP Customer Area <= 8.2.4 - Event Log Deletion via CSRF↗2025-01-27
▶
CVE-2024-12280 (MEDIUM CVSS 4.3) | The WP Customer Area WordPress plug | cvebase.io