CVE-2024-4382 CB (legacy) <= 0.9.4.18 - Code/Timeframe/Booking Deletion via CSRF

2024-06-2106:00:04

WPScan

github.com

cb (legacy) wordpress plugin

csrf

vulnerability

bulk actions

admins

deletion .

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

18.3%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

The CB (legacy) WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting codes, timeframes, and bookings via CSRF attacks

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "CB (legacy)",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "0.9.4.18"
      }
    ],
    "defaultStatus": "affected"
  }
]