WordPress Plugin Vulnerabilities

Church Admin < 4.0.28 - Cross-Site Request Forgery

Description

The Church Admin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.27. This is due to missing or incorrect nonce validation on the ca_debug_mode() function. This makes it possible for unauthenticated attackers to enable debug mode via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
church-admin
Fixed in 4.0.28

References

CVE
CVE-2024-32090
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/97312cf2-dcff-466f-a27c-25686216ed04

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Dhabaleshwar Das
Verified
No
WPVDB ID
db0e3558-701a-401a-8446-f5270e8dab45

Timeline

Publicly Published
2024-04-11 (about 2 years ago)
Added
2024-04-17 (about 2 years ago)
Last Updated
2024-04-17 (about 2 years ago)

Other

Published
Title
Published
2024-03-12
Title
Tutor LMS – eLearning and online course solution < 2.6.2 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase
Published
2014-08-01
Title
Wordpress 3.3.1 - Multiple Cross-Site Request Forgery (CSRF)
Published
2025-04-11
Title
Webcraftic Clearfy – WordPress optimization plugin < 2.3.3 - Cross-Site Request Forgery to Plugin Settings Update via 'setup-wbcr_clearfy'
Published
2025-03-27
Title
Custom Field For WP Job Manager < 1.5 - Cross-Site Request Forgery
Published
2026-03-20
Title
Post Snippits <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update