CVE-2024-13795

Summary

CVE-2024-13795: A Cross-Site Request Forgery (CSRF) vulnerability affects the Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress. Versions up to and including 6.12.27 are impacted. The issue stems from faulty or absent nonce validation on the ecwid_deactivate_feedback() function. As a consequence, unauthenticated attackers can deactivate plugins on affected sites by tricking administrators into executing a malicious link, potentially leading to serious consequences. Site owners are advised to update their Ecwid plugin to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.