CVE-2024-10593
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Published Nov 13, 2024
CWE ID 352
Summary
CVE-2024-10593 is a vulnerability affecting the WPForms plugin for WordPress. Versions up to and including 1.9.1.6 are susceptible to Cross-Site Request Forgery (CSRF). This issue arises due to inadequate nonce validation on the process_admin_ui function. As a result, unauthenticated attackers can manipulate administrators into executing malicious requests, leading to the deletion of WPForm logs. This vulnerability poses a significant risk, emphasizing the importance of promptly updating the plugin to a secure version.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.