PT-2024-24399 · Churchthemes · Church Content – Sermons

Dhabaleshwar Das · Published 2024-04-15 · Updated 2024-04-15 · CVE-2024-32094

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Church Content – Sermons, Events and More versions through 2.6

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability in ChurchThemes Church Content – Sermons, Events and More. This vulnerability can be exploited due to improper validation of user-supplied input.

Recommendations For versions through 2.6, update to a patched version once available. As a temporary workaround, consider auditing the plugin code to ensure proper validation of user-supplied input.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-32094

Affected Products

Church Content – Sermons

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-32094 · Security Note
• https://twitter.com/oktsec/status/1779837786729713666 · Twitter Post
• https://twitter.com/CVEnew/status/1779800504496763116 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1779822599691702693 · Twitter Post
• https://patchstack.com/database/vulnerability/church-theme-content/wordpress-church-content-plugin-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note