CVE Catalog
CVE-2024-3824
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk0.20%
10th percentile - higher than 10% of all known CVEs
Summary
The Base64 Encoder/Decoder WordPress plugin through version 0.9.2 lacks CSRF check when resetting its settings, allowing an attacker to trick a logged-in admin into resetting them via a CSRF attack.
Risk Assessment
An attacker can change the plugin configuration without the admin's knowledge, potentially leading to malfunction or further vulnerabilities.
Recommendation
Update the plugin to a version that adds CSRF protection, or temporarily disable the settings reset functionality.
Original NVD description (English source)
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack