WordPress Plugin Vulnerabilities

Leadinfo < 1.1 - Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
leadinfo
Fixed in 1.1

References

CVE
CVE-2024-32112
URL
https://patchstack.com/database/vulnerability/leadinfo/wordpress-leadinfo-plugin-1-0-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Nguyen Xuan Chien
Verified
Yes
WPVDB ID
e1025338-8ada-4e19-bc19-81743b273857

Timeline

Publicly Published
2024-04-11 (about 2 years ago)
Added
2024-04-17 (about 2 years ago)
Last Updated
2024-04-19 (about 2 years ago)

Other

Published
Title
Published
2025-02-24
Title
无觅相关文章插件 <= 1.0.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2022-05-31
Title
WP Sentry <= 1.0 - Arbitrary Settings Update to Stored XSS via CSRF
Published
2014-08-01
Title
WP Easy Gallery < 2.7.3 - Cross-Site Request Forgery (CSRF)
Published
2026-02-01
Title
Grand Photography <= 5.7.8 - Cross-Site Request Forgery
Published
2024-04-24
Title
CM Tooltip Glossary < 4.3.0 - Settings Update via CSRF