CVE-2021-24809 BP Better Messages < 1.9.9.41 - Multiple CSRF

2021-11-0108:46:30

CWE-352

WPScan

www.cve.org

cve-2021-24809

wordpress

csrf

ajax actions

security

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

47.5%

JSON

The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions

CNA Affected

[
  {
    "product": "BP Better Messages",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.9.9.41",
        "status": "affected",
        "version": "1.9.9.41",
        "versionType": "custom"
      }
    ]
  }
]