Lucene search
Bob MatyasWPVDB-ID:0E1BA2B3-5849-42F6-B503-8B3B520E4A79HistoryMay 24, 2024 - 12:00 a.m.
Pray For Me <= 1.0.4 - Settings Update via CSRF
2024-05-2400:00:00
Bob Matyas
wpscan.com
1
csrf
settings update
security vulnerability
pray for me
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PoC
Make a logged in admin open an HTML file containing:
Related
vulnrichment
vulnrichment
CVE-2024-3965 Pray For Me <= 1.0.4 - Settings Update via CSRF
2024-06-14 06:00:02
wpexploit
wpexploit
Pray For Me <= 1.0.4 - Settings Update via CSRF
2024-05-24 00:00:00
cvelist
cvelist
CVE-2024-3965 Pray For Me <= 1.0.4 - Settings Update via CSRF
2024-06-14 06:00:02
cve
cve
CVE-2024-3965
2024-06-14 06:15:12
nvd
nvd
CVE-2024-3965
2024-06-14 06:15:12
wordfence
wordfence
6.2 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%
Related for WPVDB-ID:0E1BA2B3-5849-42F6-B503-8B3B520E4A79