PT-2024-36739 · Social · Sinking Dropdowns

Mika · Published 2024-12-31 · Updated 2024-12-31 · CVE-2024-56204

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sinking Dropdowns versions n/a through 1.25

Description A Cross-Site Request Forgery (CSRF) vulnerability is present in Yonatan Reinberg of Social Ink's Sinking Dropdowns, allowing Privilege Escalation.

Recommendations For versions n/a through 1.25, consider disabling the functionality that allows Cross-Site Request Forgery (CSRF) attacks until a patch is available. As a temporary workaround, restrict access to sensitive operations to minimize the risk of exploitation. Avoid using the vulnerable component of Sinking Dropdowns in sensitive environments until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-56204

Affected Products

Sinking Dropdowns

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-56204 · Security Note
• https://t.me/latest_high_impact_cve/1741 · Telegram Post
• https://t.me/cvenotify/105837 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/sinking-dropdowns/vulnerability/wordpress-sinking-dropdowns-plugin-1-25-csrf-to-privilege-escalation-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1874085994229645535 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1874145275087847850 · Twitter Post
• https://t.me/cvedetector/14023 · Telegram Post
• https://patchstack.com/database/wordpress/plugin/sinking-dropdowns/vulnerability/wordpress-sinking-dropdowns-plugin-1-25-csrf-to-privilege-escalation-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1874087595342213238 · Twitter Post