CVE-2024-12170

Summary

CVE-2024-12170 is a Cross-Site Request Forgery vulnerability affecting the ViewMedica 9 plugin for WordPress. Versions up to and including 1.4.15 are susceptible to this issue. The vulnerability stems from inadequate or absent nonce validation on the 'Viewmedica-Admin' page. Consequently, unauthenticated assailants can manipulate administrators into performing actions, such as clicking on a malicious link, leading to the injection of arbitrary SQL queries. This flaw poses a significant threat to WordPress sites using the ViewMedica 9 plugin and demands immediate attention from administrators to apply the necessary updates.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.