CVE-2024-0768
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Published Feb 28, 2024
Updated: Jan 8, 2025
CWE ID 352
Summary
CVE-2024-0768 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress. Versions up to and including 1.4.4 are susceptible to this issue. The vulnerability stems from insufficient nonce validation on the ajax_theme_activation function, resulting in unauthenticated attackers being able to trigger arbitrary theme activations via manipulated requests. Site administrators may fall prey to this attack if they are coerced into executing a malicious link.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.