PT-2024-13814 · Klbtheme · Klbtheme Bacola+6

Fearzzzz + 2 · Published 2024-03-26 · Updated 2024-03-26 · CVE-2023-49838

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions KlbTheme Clotya theme versions 1.1.6 and earlier KlbTheme Cosmetsy theme versions 1.7.7 and earlier KlbTheme Furnob theme versions 1.2.2 and earlier KlbTheme Bacola theme versions 1.3.3 and earlier KlbTheme Partdo theme versions 1.1.1 and earlier KlbTheme Medibazar theme versions 1.8.6 and earlier KlbTheme Machic theme versions 1.2.8 and earlier

Description A Cross-Site Request Forgery (CSRF) issue affects several KlbTheme products. This issue allows for malicious requests to be made on behalf of the user without their knowledge or consent.

Recommendations For KlbTheme Clotya theme versions 1.1.6 and earlier, update to a version that includes a fix for this issue. For KlbTheme Cosmetsy theme versions 1.7.7 and earlier, update to a version that includes a fix for this issue. For KlbTheme Furnob theme versions 1.2.2 and earlier, update to a version that includes a fix for this issue. For KlbTheme Bacola theme versions 1.3.3 and earlier, update to a version that includes a fix for this issue. For KlbTheme Partdo theme versions 1.1.1 and earlier, update to a version that includes a fix for this issue. For KlbTheme Medibazar theme versions 1.8.6 and earlier, update to a version that includes a fix for this issue. For KlbTheme Machic theme versions 1.2.8 and earlier, update to a version that includes a fix for this issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-49838

Affected Products

Klbtheme Bacola

Klbtheme Clotya

Klbtheme Cosmetsy

Klbtheme Furnob

Klbtheme Machic

Klbtheme Medibazar

Klbtheme Partdo

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-49838 · Security Note
• https://patchstack.com/database/vulnerability/cosmetsy/wordpress-cosmetsy-theme-1-7-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/clotya/wordpress-clotya-theme-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/machic/wordpress-machic-theme-1-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/bacola/wordpress-bacola-theme-1-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/furnob/wordpress-furnob-theme-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/partdo/wordpress-partdo-theme-1-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/medibazar/wordpress-medibazar-theme-1-8-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note