CVE-2024-0767

Summary

CVE-2024-0767 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress. Versions up to and including 1.4.4 are impacted by this issue. The vulnerability arises due to insufficient nonce validation on the ajax_plugin_activation function. An attacker can exploit this weakness by crafting a malicious request and tricking a site administrator into executing it, allowing the attacker to activate arbitrary plugins without authentication. This poses a significant risk to WordPress sites using the affected plugin.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.