CVE-2024-0830
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Comments Extra Fields For Post, Pages and CPT plugin for WordPress up to version 5.0 is vulnerable to Cross-Site Request Forgery. Several AJAX actions lack nonce validation, allowing unauthenticated attackers to invoke them via a forged request if they trick a site administrator into clicking a link. This can lead to modification of comment form fields and plugin settings.
Risk Assessment
An attacker can use CSRF to unauthorizedly change plugin settings or form fields, potentially leading to data integrity issues or injection of malicious content.
Recommendation
Update the plugin to the latest version that includes CSRF fixes. If not available, ensure administrators do not click on suspicious links.
Other vulnerabilities in Comments Extra Fields For Post, Pages and CPT
Original NVD description (English source)
The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0. This is due to missing or incorrect nonce validation on several ajax actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. As a result, they may modify comment form fields and update plugin settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS