CVE-2024-7386
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Published Sep 25, 2024
Updated: Sep 26, 2024
CWE ID 352
Summary
CVE-2024-7386 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Premium Packages – Sell Digital Products Securely plugin for WordPress. Versions up to 5.9.1 are vulnerable, as the addRefund() function lacks nonce validation. Attackers can exploit this flaw to initiate refunds via forged requests. The vulnerability poses a risk as it can be exploited even without authentication, making it crucial for users to update their plugins to the latest version and practice secure browsing habits.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.