Lucene search

PatchstackCVE-2024-34809

HistoryMay 17, 2024 - 10:15 a.m.

CVE-2024-34809

2024-05-1710:15:14

CWE-352

Patchstack

web.nvd.nist.gov

cve-2024-34809

extend themes empowerwp

csrf vulnerability

nvd

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.0%

JSON

Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes EmpowerWP.This issue affects EmpowerWP: from n/a through 1.0.21.

Affected configurations

Vulners

Vulnrichment

Node

extend_themesempowerwpRange≤1.0.21wordpress

VendorProductVersionCPE
extend_themesempowerwp*cpe:2.3:a:extend_themes:empowerwp:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
extend_themes	empowerwp	*	cpe:2.3:a:extend_themes:empowerwp::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/themes",
    "defaultStatus": "unaffected",
    "packageName": "empowerwp",
    "product": "EmpowerWP",
    "vendor": "Extend Themes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.22",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.21",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/empowerwp/wordpress-empowerwp-theme-1-0-21-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-34809