CVE-2024-1360: 
WordPress vulnerability analysis and mitigation

The Colibri WP theme for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability tracked as CVE-2024-1360, affecting all versions up to and including 1.0.94. The vulnerability was discovered in February 2024 and is related to missing or incorrect nonce validation in the colibriwp_install_plugin() function (NVD).

The vulnerability stems from improper security controls in the colibriwp_install_plugin() function, specifically the absence of proper nonce validation. This security flaw has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating network accessibility with low attack complexity but requiring user interaction (NVD).

The vulnerability allows unauthenticated attackers to install recommended plugins through forged requests, provided they can trick a site administrator into performing specific actions like clicking on a malicious link (NVD).

The vulnerability requires user interaction in the form of an administrator clicking on a malicious link. While the attack complexity is considered low, successful exploitation depends on social engineering tactics to convince administrators to interact with malicious content (NVD).

A patch has been released to address this vulnerability. Website administrators should update their Colibri WP theme to version 1.1.101 or later, which includes the security fix (WordPress Themes).