PT-2024-37258 · WordPress · Nested Pages

Bassem Essam

·

Published

2024-07-04

·

Updated

2024-07-08

·

CVE-2024-5943

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Nested Pages plugin for WordPress versions up to, and including, 3.2.7
Description: The issue is due to missing or incorrect nonce validation on the settingsPage function and missing sanitization of the tab parameter. This makes it possible for unauthenticated attackers to call local php files via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. Attackers can exploit this flaw to execute unauthorized actions via manipulated requests.
Recommendations: For Nested Pages plugin for WordPress versions up to, and including, 3.2.7: As a temporary workaround, consider disabling the settingsPage function until a patch is available. Restrict access to the tab parameter to minimize the risk of exploitation. Avoid using the tab parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-5943

Affected Products

Nested Pages