CVE-2024-7492

Summary

CVE-2024-7492 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the MainWP Child Reports plugin for WordPress. Versions up to and including 2.2 are impacted by this issue. The root cause lies in the lack of proper nonce validation on the network_options_action() function. This defect enables unauthenticated attackers to manipulate arbitrary options on multisite instances. Successful exploitation requires the attacker to trick a site administrator into executing a malicious action, such as clicking a crafted link. Privilege escalation is a potential consequence of this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.