CVE-2024-9847: 
FlatPress vulnerability analysis and mitigation

FlatPress CMS version latest was identified with a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2024-9847), discovered and disclosed on March 20, 2025. This vulnerability affects the plugin management functionality of the CMS, allowing attackers to enable or disable plugins without proper authorization (NVD).

The vulnerability is classified as a Cross-Site Request Forgery (CWE-352) with a CVSS v3.0 base score of 8.0 (HIGH), with the vector string CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. The issue allows an attacker to craft malicious links or scripts that, when clicked by an authenticated user, send unauthorized requests to the FlatPress CMS server to manipulate plugin states (NVD).

When exploited, the vulnerability allows attackers to enable or disable plugins on behalf of a victim user. Since the requests are processed with the victim's authentication, the server treats these actions as legitimate, effectively bypassing the intended authorization controls (NVD).

The vulnerability requires an attacker to craft a malicious link or script and have an authenticated user click on it. The server will then process the request as if it were legitimately initiated by the authenticated user (NVD).

The vulnerability has been fixed in FlatPress version 1.4.dev. Users are advised to upgrade to this version to protect against potential CSRF attacks. The fix includes implementing proper validation and cleanup before performing sensitive operations (Github Commit).