PT-2024-18360 · WordPress · Wp Customer Reviews

Dmitry Ignatyev · Published 2024-04-08 · Updated 2025-05-08 · CVE-2024-1849

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Customer Reviews versions prior to 3.7.1

Description The issue concerns the WP Customer Reviews WordPress plugin, where a parameter is not validated, allowing contributor and above users to redirect a page to a malicious URL. This poses a risk to WordPress sites, potentially exposing them to malicious redirects. The flaw can be exploited by attackers to reroute unsuspecting users.

Recommendations For versions prior to 3.7.1, update to version 3.7.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable parameter to minimize the risk of exploitation. Avoid using the vulnerable parameter in the affected plugin until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2024-1849

Affected Products

Wp Customer Reviews

References · 6

• 🔥 https://wpscan.com/vulnerability/e6d9fe28-def6-4f25-9967-a77f91899bfe · Exploit
• https://osv.dev/vulnerability/CVE-2024-1849 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1849 · Security Note
• https://twitter.com/CVEnew/status/1779742845714215088 · Twitter Post
• https://t.me/cvenotify/121444 · Telegram Post
• https://twitter.com/cleantalkcloud/status/1777576555629162517 · Twitter Post