CVE-2024-5167: 
WordPress vulnerability analysis and mitigation

The CM Email Registration Blacklist and Whitelist WordPress plugin before version 1.4.9 contains a Cross-Site Request Forgery (CSRF) vulnerability. The vulnerability was discovered by Felipe Caon and was assigned CVE-2024-5167. The plugin lacks CSRF protection mechanisms when adding or deleting items from the blacklist or whitelist menus (WPScan).

The vulnerability stems from the absence of CSRF checks in the plugin's functionality for managing blacklist and whitelist entries. This security flaw affects the plugin's administrative interface, specifically when adding or deleting items from both the blacklist and whitelist menus. The vulnerability has been assigned a CVSS score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H (WPScan).

If exploited, this vulnerability could allow attackers to manipulate the email blacklist and whitelist settings through a CSRF attack, potentially forcing administrators to unknowingly add or delete entries from these lists. This could lead to unauthorized modifications of the plugin's security settings, potentially impacting the email registration filtering system (WPScan).

The vulnerability can be exploited through CSRF attacks targeting specific administrative actions. Example exploit paths include accessing URLs for deleting items from blacklist or whitelist using specific IDs, and submitting forms to add new entries to either list. The attack requires an authenticated administrator to click on a malicious link or visit a compromised page (WPScan).

The vulnerability has been patched in version 1.4.9 of the CM Email Registration Blacklist and Whitelist plugin. Users are strongly advised to update to this version or later to protect against potential CSRF attacks (WPScan).