PT-2024-18304 · WordPress · Contests By Rewards Fuel

Sean Bales · Published 2024-03-19 · Updated 2024-03-21 · CVE-2024-1785

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contests by Rewards Fuel plugin for WordPress versions up to, and including, 2.0.62

Description The issue is due to missing or incorrect nonce validation on the ajax handler() function, making it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request. This can be achieved if an attacker can trick a site's user with the edit posts capability into performing an action such as clicking on a link.

Recommendations For versions up to, and including, 2.0.62, update to a version higher than 2.0.62 to resolve the issue. As a temporary workaround, consider disabling the ajax handler() function until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-1785

Affected Products

Contests By Rewards Fuel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-1785 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3039978%40contests-from-rewards-fuel&new=3039978%40contests-from-rewards-fuel&sfp_email=&sfph_mail= · Note
• https://twitter.com/RedPacketSec/status/1770753775722016938 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1770322478478266522 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/689f3667-2dda-40a8-8627-d38c6c6816fc?source=cve · Note
• https://twitter.com/CVEnew/status/1770274213531636040 · Twitter Post