CVE-2024-4532 - Business Card <= 1.0.0 - Arbitrary Card Deletion via CSRF

Back Back to CVE browser

MEDIUM

Business Card <= 1.0.0 - Arbitrary Card Deletion via CSRF

Published May 27, 2024

6.4

MEDIUM

CVSS 3.1

EPSS 0.28%

Description

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting cards via CSRF attacks

Affected products

Vendor n/a Product Business Card Default
affected
- Version
  0
  Status
  affected
  Constraints
  <=1.0.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Business Card

affected

Version	Status	Constraints
0	affected	<=1.0.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44146
Advisory
https://wpscan.com/vulnerability/64cf5f95-bbf0-4c5f-867b-62f1b7f6a42e/
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44146		Advisory
https://wpscan.com/vulnerability/64cf5f95-bbf0-4c5f-867b-62f1b7f6a42e/		exploitvdb-entrytechnical-descriptionThird Party Advisory