Cross-Site Request Forgery (CSRF) (CWE-352)
The adstxt Plugin WordPress plugin through version 1.0.0 lacks a Cross-Site Request Forgery (CSRF) check when updating its settings. This vulnerability could allow attackers to manipulate the plugin's settings through a CSRF attack, potentially compromising the integrity of the WordPress site.
If exploited, this vulnerability could enable attackers to change the plugin's settings without the admin's knowledge or consent. This could lead to unauthorized modifications of the ads.txt file, potentially impacting the site's ad revenue or allowing malicious ads to be served. The integrity of the site's advertising setup could be compromised, though the confidentiality of data and overall availability of the site are not directly affected.
One proof-of-concept exploit is available on wpscan.com. There is no evidence of proof of exploitation at the moment.
As of the latest information provided, a patch is not explicitly mentioned. The vulnerability affects the adstxt Plugin WordPress plugin through version 1.0.0, suggesting that users should look for updates beyond this version or consider alternative solutions until a patched version is released.
To mitigate this vulnerability: 1. Update the adstxt Plugin to a version newer than 1.0.0 if available. 2. If an update is not available, consider temporarily disabling the plugin until a patch is released. 3. Implement additional security measures such as Web Application Firewalls (WAF) that can help protect against CSRF attacks. 4. Educate administrators about the risks of CSRF attacks and advise them to be cautious when clicking on unknown links while logged into the WordPress admin panel. 5. Regularly monitor the plugin's settings for any unauthorized changes. 6. Consider implementing additional CSRF protections at the WordPress level if possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD published the first details for CVE-2024-7892
Feedly found the first article mentioning CVE-2024-7892. See article
Feedly estimated the CVSS score as MEDIUM
A CVSS base score of 4.3 has been assigned.