CVE-2024-12280: 
WordPress Analisi e mitigazione delle vulnerabilità

The WP Customer Area WordPress plugin through version 8.2.4 contains a Cross-Site Request Forgery (CSRF) vulnerability that affects its log deletion functionality. The vulnerability was discovered by Krugov Artyom and was assigned CVE-2024-12280. This security issue was publicly disclosed on January 6, 2025 (WPScan).

The vulnerability stems from the absence of CSRF protection mechanisms when deleting logs in the WP Customer Area plugin. It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) (WPScan).

When exploited, this vulnerability allows attackers to trick authenticated users into deleting logs from the WP Customer Area plugin through a CSRF attack. The impact is limited to log deletion functionality, affecting the integrity of the logging system (WPScan).

The vulnerability has been fixed in version 8.2.5 of the WP Customer Area plugin. Users are advised to update to this version or later to protect against potential CSRF attacks (WPScan).