CVE-2024-3163 Easy Property Listings < 3.5.4 - Arbitrary Contact Deletion via CSRF

2024-09-1206:00:02

WPScan

www.cve.org

wordpress

plugin

csrf

attack

contact deletion

EPSS

0.001

Percentile

17.7%

JSON

The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Easy Property Listings",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "3.5.4"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/f89c8654-5486-4939-880d-101f33d359c0/

EPSS

0.001

Percentile

17.7%

JSON

Related for CVELIST:CVE-2024-3163