CVE-2024-13647
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Published Feb 27, 2025
CWE ID 352
Summary
CVE-2024-13647 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the SakolaWP plugin for WordPress, specifically in versions up to 1.0.8. The flaw arises from inadequate nonce validation on the 'save_exam_setting' and 'delete_exam_setting' actions. This vulnerability allows unauthenticated attackers to manipulate exam settings by tricking site administrators into executing a malicious request, making this a significant security concern for WordPress installations using the SakolaWP plugin.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- School Management System Plugin
Affected Vendors
- WordPress