CVE-2024-2326
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Summary
CVE-2024-2326 is a vulnerability in the Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin for WordPress. The vulnerability exists in all versions up to and including 3.6.3 and is categorized as Cross-Site Request Forgery (CSRF). This vulnerability occurs due to missing or incorrect nonce validation when saving plugin settings. It allows unauthenticated attackers to manipulate the plugin's configuration, including stripe integration, by tricking site administrators into taking actions such as clicking on a link. The risk score for this vulnerability is 5 out of 10, with a base severity of medium. Remediation measures should include updating the affected plugin to the latest version or applying any available patches to address this vulnerability. Organizations using this WordPress plugin should be aware of the potential danger it poses in terms of unauthorized configuration changes and take necessary steps to mitigate the risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions