CVE-2024-3631 HL Twitter <= 2014.1.18 - Unlink Twitter Account via CSRF

2024-05-1506:00:04

WPScan

github.com

cve-2024-3631

csrf

unlinking accounts

AI Score

6.7

Confidence

High

EPSS

Percentile

9.0%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "HL Twitter",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "2014.1.18"
      }
    ],
    "defaultStatus": "affected"
  }
]