CVE-2024-13758

Summary

CVE-2024-13758 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the CP Contact Form with PayPal plugin for WordPress. Versions up to and including 1.3.52 of the plugin are susceptible to this issue. The root cause is insufficient nonce validation on the cp_contact_form_paypal_check_init_actions() function. Consequently, unauthenticated attackers can manipulate site administrators into executing actions, such as adding discount codes, via a specially crafted link. This can lead to potential security breaches and unauthorized modifications to the system.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.