CVE-2024-1504

Summary

CVE-2024-1504 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the SecuPress Free WordPress Security plugin. Versions up to and including 2.2.5.1 are impacted. The issue arises from missing or incorrect nonce validation on the secupress_blackhole_ban_ip() function. An attacker can exploit this vulnerability by tricking a user into performing an action, such as clicking a malicious link, which results in the attacker being able to block the user's IP address unauthorizedly. This can potentially lead to denial-of-service (DoS) attacks and unauthorized access to the affected WordPress site. Users are recommended to update the plugin to a patched version as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.