CVE-2024-6857

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 74.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown WP MultitaskingNgothang WP Multitasking
Timeline
PublishedApr 9

Description

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5unknown/wp_multitasking0.1.12

🔴Vulnerability Details

2
CVEList
WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF↗2025-04-09
▶
GHSA
GHSA-9cjm-fv5h-54p6: The WP MultiTasking WordPress plugin through 0↗2025-04-09
▶
CVE-2024-6857 (MEDIUM CVSS 4.3) | The WP MultiTasking WordPress plugi | cvebase.io