PT-2023-32951 · Php · Php

Bob Matyas · Published 2023-10-24 · Updated 2025-05-15 · CVE-2024-3824

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Base64 Encoder/Decoder WordPress plugin versions 0.9.2 and earlier PHP versions prior to 8.0.30 PHP versions prior to 8.1.22 PHP versions prior to 8.2.8

Description The issue concerns a lack of CSRF check in the Base64 Encoder/Decoder WordPress plugin, allowing attackers to reset settings via a CSRF attack. Additionally, there is an issue in PHP when loading phar files.

Recommendations For the Base64 Encoder/Decoder WordPress plugin version 0.9.2 and earlier, consider disabling the settings reset functionality until a patch is available. For PHP versions prior to 8.0.30, update to version 8.0.30 or later. For PHP versions prior to 8.1.22, update to version 8.1.22 or later. For PHP versions prior to 8.2.8, update to version 8.2.8 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-3824

Affected Products

Php

References · 7

• 🔥 https://wpscan.com/vulnerability/749ae334-b1d1-421e-a04c-35464c961a4a · Exploit
• https://osv.dev/vulnerability/CVE-2024-3824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3824 · Security Note
• https://t.me/cvenotify/116566 · Telegram Post
• https://twitter.com/cve_security_g/status/1717017458035568935 · Twitter Post
• https://t.me/cvenotify/122306 · Telegram Post
• https://t.me/cvenotify/79830 · Telegram Post