CVE-2024-12557
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Jan 7, 2025
CWE ID 352
Summary
CVE-2024-12557: The Transporters.io plugin for WordPress contains a Cross-Site Request Forgery vulnerability, affecting versions up to 2.0.84. This issue stems from insufficient nonce validation on a specific function. Consequently, unauthenticated attackers can inject malicious web scripts by deceiving site administrators into executing malicious actions, such as clicking on a malicious link. This flaw poses a significant risk to WordPress sites using the Transporters.io plugin and necessitates immediate patching to mitigate the threat.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.