CVE-2024-8476
Cross-Site Request Forgery (CSRF) (CWE-352)
Summary
The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 1.2.1. This vulnerability is due to missing or incorrect nonce validation on the wpeevent_plugin_buttons() function. It allows unauthenticated attackers to delete arbitrary posts via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.
Impact
The impact of this vulnerability is primarily on the integrity of the WordPress site using the affected plugin. Attackers can potentially delete arbitrary posts, which could lead to loss of content and disruption of the website's functionality. The attack requires user interaction, as the attacker needs to trick a site administrator into clicking a malicious link. There is no direct impact on confidentiality or availability of the system.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been fixed in version 1.2.2 of the Easy PayPal Events plugin. The patch was added on October 2, 2024, and can be found in the WordPress plugin repository.
Mitigation
To mitigate this vulnerability, the following steps are recommended: 1. Update the Easy PayPal Events plugin to version 1.2.2 or later, which includes the patch for this vulnerability. 2. If immediate updating is not possible, consider temporarily disabling the Easy PayPal Events plugin until it can be updated. 3. Educate site administrators about the risks of clicking on unknown links, especially when logged into the WordPress admin panel. 4. Implement general security best practices such as using strong, unique passwords and enabling two-factor authentication for WordPress admin accounts. 5. Regularly backup your WordPress site to ensure quick recovery in case of any successful attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Timeline
Feedly found the first article mentioning CVE-2024-8476. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-8476
A CVSS base score of 4.3 has been assigned.
Feedly estimated the CVSS score as LOW
EPSS Score was set to: 0.05% (Percentile: 21%)