CVE-2024-12280: 
WordPress vulnerability analysis and mitigation

The WP Customer Area WordPress plugin through version 8.2.4 contains a Cross-Site Request Forgery (CSRF) vulnerability that affects its log deletion functionality. The vulnerability was discovered by Krugov Artyom and was assigned CVE-2024-12280. This security issue was publicly disclosed on January 6, 2025 (WPScan).

The vulnerability stems from the absence of CSRF protection mechanisms when deleting logs in the WP Customer Area plugin. It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) (WPScan).

When exploited, this vulnerability allows attackers to trick authenticated users into deleting logs from the WP Customer Area plugin through a CSRF attack. The impact is limited to log deletion functionality, affecting the integrity of the logging system (WPScan).

A proof of concept exists where an attacker can create an HTML file containing malicious code that, when opened by an administrator, will trigger the deletion of existing logs. The attack requires user interaction as the victim must be authenticated and must access the malicious HTML file (WPScan).

The vulnerability has been fixed in version 8.2.5 of the WP Customer Area plugin. Users are advised to update to this version or later to protect against potential CSRF attacks (WPScan).