PT-2025-2131 · WordPress · Dsgvo All In One For Wp
Khayal Farzaliyev
+1
·
Publicado
2025-02-04
·
Atualizado
2025-05-23
·
CVE-2024-13356
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
DSGVO All in one for WP plugin for WordPress versions up to, and including, 4.6
Description
The issue is due to missing or incorrect nonce validation in the user remove form.php file, making it possible for unauthenticated attackers to delete admin user accounts via a forged request. This can happen if an attacker can trick a site administrator into performing an action such as clicking on a link.
Recommendations
For versions up to, and including, 4.6, consider disabling the user remove form.php file or restricting access to it until a patch is available. As a temporary workaround, restrict the ability to delete admin user accounts to minimize the risk of exploitation. Avoid using the DSGVO All in one for WP plugin for WordPress until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Dsgvo All In One For Wp