CVE-2024-12280:
WordPress Análisis y mitigación de vulnerabilidades
Vista general
The WP Customer Area WordPress plugin through version 8.2.4 contains a Cross-Site Request Forgery (CSRF) vulnerability that affects its log deletion functionality. The vulnerability was discovered by Krugov Artyom and was assigned CVE-2024-12280. This security issue was publicly disclosed on January 6, 2025 (WPScan).
Técnicas
The vulnerability stems from the absence of CSRF protection mechanisms when deleting logs in the WP Customer Area plugin. It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) (WPScan).
Impacto
When exploited, this vulnerability allows attackers to trick authenticated users into deleting logs from the WP Customer Area plugin through a CSRF attack. The impact is limited to log deletion functionality, affecting the integrity of the logging system (WPScan).
Mitigación y soluciones alternativas
The vulnerability has been fixed in version 8.2.5 of the WP Customer Area plugin. Users are advised to update to this version or later to protect against potential CSRF attacks (WPScan).
Recursos adicionales
Fuente: Este informe se generó utilizando IA
Relacionado WordPress Vulnerabilidades:
Evaluación gratuita de vulnerabilidades
Compare su postura de seguridad en la nube
Evalúe sus prácticas de seguridad en la nube en 9 dominios de seguridad para comparar su nivel de riesgo e identificar brechas en sus defensas.
Recursos adicionales de Wiz
Obtén una demostración personalizada
¿Listo para ver a Wiz en acción?
"La mejor experiencia de usuario que he visto en mi vida, proporciona una visibilidad completa de las cargas de trabajo en la nube."
"Wiz proporciona un panel único para ver lo que ocurre en nuestros entornos en la nube."
"Sabemos que si Wiz identifica algo como crítico, en realidad lo es."