PT-2024-38424 · WordPress · Favicon Generator

Marco Wotschka

·

Published

2024-08-23

·

Updated

2024-09-27

·

CVE-2024-7568

CVSS v3.1

9.6

Critical

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Favicon Generator plugin for WordPress versions up to, and including, 1.5
Description The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the output sub admin page 0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Recommendations For Favicon Generator plugin for WordPress versions up to, and including, 1.5, the plugin author deleted the functionality of the plugin to patch this issue and close the plugin. We recommend seeking an alternative to this plugin. As a temporary workaround, consider disabling the output sub admin page 0 function until a suitable replacement is found. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the plugin until a secure alternative is implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-7568

Affected Products

Favicon Generator