PT-2024-36274 · Unknown · Phuc Pham Multiple Admin Emails

Muhamad Agil Fachrian · Published 2024-12-16 · Updated 2024-12-16 · CVE-2024-54388

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Phuc Pham Multiple Admin Emails versions n/a through 1.0

Description: The issue is related to a Cross-Site Request Forgery (CSRF) problem, which allows for Cross Site Request Forgery. This affects the multiple admin emails functionality.

Recommendations: For versions n/a through 1.0, consider disabling the multiple admin emails feature until a patch is available to prevent Cross Site Request Forgery. Restrict access to sensitive areas of the application to minimize the risk of exploitation. Avoid performing sensitive actions without proper validation to prevent CSRF attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-54388

Affected Products

Phuc Pham Multiple Admin Emails

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-54388 · Security Note
• https://twitter.com/CVEnew/status/1868666514691547585 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/multiple-admin-emails/vulnerability/wordpress-multiple-admin-emails-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/multiple-admin-emails/vulnerability/wordpress-multiple-admin-emails-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve · Note