CVE-2024-12572

Summary

CVE-2024-12572 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Hello In All Languages plugin for WordPress. Versions up to and including 1.0.6 are vulnerable due to inadequate nonce validation in a specific function. This issue enables unauthenticated attackers to manipulate plugin settings and inject malicious web scripts by tricking administrators into executing a malicious request, such as clicking on a link. The vulnerability poses a significant risk, as successful exploitation could lead to serious website compromises. It is strongly recommended that users update to the latest version of the plugin as soon as possible to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.