CVE-2024-10045

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-10045
The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the process_actions function. This makes it possible for unauthenticated attackers to delete transients via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/transients-manager/trunk/src/TransientsManager.php#L993 Product
https://plugins.trac.wordpress.org/changeset/3171619/transients-manager/trunk/src/TransientsManager.php Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/03b8b5a2-979d-42d0-86f5-48ee73162d22?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpbeginner:transients_manager:*:*:*:*:*:wordpress:*:*
History

25 Oct 2024, 18:52

Type Values Removed Values Added
First Time Wpbeginner
Wpbeginner transients Manager
References () https://plugins.trac.wordpress.org/browser/transients-manager/trunk/src/TransientsManager.php#L993 - () https://plugins.trac.wordpress.org/browser/transients-manager/trunk/src/TransientsManager.php#L993 - Product
References () https://plugins.trac.wordpress.org/changeset/3171619/transients-manager/trunk/src/TransientsManager.php - () https://plugins.trac.wordpress.org/changeset/3171619/transients-manager/trunk/src/TransientsManager.php - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/03b8b5a2-979d-42d0-86f5-48ee73162d22?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/03b8b5a2-979d-42d0-86f5-48ee73162d22?source=cve - Third Party Advisory
CPE cpe:2.3:a:wpbeginner:transients_manager:*:*:*:*:*:wordpress:*:*

23 Oct 2024, 15:12

Type Values Removed Values Added
Summary
  • (es) El complemento Transients Manager para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 2.0.6 incluida. Esto se debe a la falta o la validación incorrecta de nonce en la función process_actions. Esto hace posible que atacantes no autenticados eliminen transitorios a través de una solicitud falsificada, siempre que puedan engañar a un administrador del sitio para que realice una acción como hacer clic en un enlace.

23 Oct 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-23 08:15

Updated : 2024-10-25 18:52

NVD link : CVE-2024-10045

Mitre link : CVE-2024-10045

CVE.ORG link : CVE-2024-10045

JSON object : View

Products Affected

wpbeginner

  • transients_manager
CWE
CWE-352

Cross-Site Request Forgery (CSRF)