Lucene search
HistorySep 12, 2024 - 6:15 a.m.
CVE-2024-3163
easy property listings
wordpress plugin
csrf attack
contact deletion
security vulnerability
admin privilege escalation
CVSS3
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS
0.001
Percentile
17.7%
The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
Affected configurations
Node
realestateconnectedeasy_property_listingsRange<3.5.4wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| realestateconnected | easy_property_listings | * | cpe:2.3:a:realestateconnected:easy_property_listings:*:*:*:*:*:wordpress:*:* |
CVSS3
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS
0.001
Percentile
17.7%
Related for NVD:CVE-2024-3163