WordPress Plugin Vulnerabilities

Connexion Logs <= 3.0.2 - Log Deletion via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Proof of Concept

Affects Plugins

Plugin icon
logs-de-connexion
No known fix

References

CVE
CVE-2024-11373

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Bob Matyas
Submitter
Bob Matyas
Submitter website
https://www.bobmatyas.com
Submitter twitter
bobmatyas
Verified
Yes
WPVDB ID
e9ef847f-3a3f-4030-828b-78db0044e142

Timeline

Publicly Published
2024-11-10 (about 1 year ago)
Added
2024-12-02 (about 1 year ago)
Last Updated
2024-12-02 (about 1 year ago)

Other

Published
Title
Published
2022-06-16
Title
WP Championship < 9.3 - Multiple CSRF
Published
2024-07-11
Title
Event post < 5.9.11 - Post Metadata Update via CSRF
Published
2016-11-29
Title
Insert Html Snippet <= 1.2 - Cross-Site Request Forgery (CSRF)
Published
2024-12-11
Title
WP Mailster < 1.8.18.0 - Cross-Site Request Forgery
Published
2025-10-08
Title
WP Go Maps (formerly WP Google Maps) < 9.0.47 - Cross-Site Request Forgery to Plugin Settings Update