PT-2021-16185 · WordPress · Genie Wp Favicon

Apple502J · Published 2021-11-08 · Updated 2021-11-10 · CVE-2021-24674

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Genie WP Favicon WordPress plugin versions through 0.5.2

Description The issue concerns the lack of CSRF protection when updating the favicon, potentially allowing attackers to manipulate a logged-in admin into changing it via a CSRF attack.

Recommendations For Genie WP Favicon WordPress plugin versions through 0.5.2, consider disabling the favicon update functionality until a patch is available to prevent potential CSRF attacks.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24674

Affected Products

Genie Wp Favicon

References · 3

• 🔥 https://wpscan.com/vulnerability/26965878-c4c9-4f43-9e9a-6e58d6b46ef2 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24674 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24674 · Security Note