CVE-2024-12220
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Summary
CVE-2024-12220 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the SMS for WooCommerce plugin for WordPress. Versions up to and including 2.8.1 are impacted by this issue. The vulnerability stems from missing or incorrect nonce validation on a specific function within the plugin. Consequently, unauthenticated attackers can inject malicious web scripts into a WordPress site by tricking an administrator into executing a malicious link. This could potentially lead to unauthorized access or data theft. Users are strongly urged to upgrade to the latest version of the plugin to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.