CVE-2024-3474

Wow Skype Buttons < 4.0.4 - Button Deletion via CSRF

CVSS 8.8 HIGHEPSS 0.4%

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

02 May 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Unknown · Wow Skype Buttons

References

https://wpscan.com/vulnerability/e5c3e145-6738-4d85-8507-43ca1b1d5877/