PT-2025-15672 · WordPress · Wp Multitasking

Norbert Hofmann · Published 2025-04-09 · Updated 2025-04-09 · CVE-2024-6857

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: WP MultiTasking WordPress plugin versions 0.1.12 and earlier

Description: The issue concerns a lack of CSRF check when updating Header, Footer, and Body Script Settings. This could allow attackers to make logged-in admins perform such actions via a CSRF attack.

Recommendations: For WP MultiTasking WordPress plugin versions 0.1.12 and earlier, consider disabling the update functionality for Header, Footer, and Body Script Settings until a patch is available. Restrict access to these settings to minimize the risk of exploitation. Avoid using the plugin's settings update feature until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-6857

Affected Products

Wp Multitasking

References · 7

• 🔥 https://wpscan.com/vulnerability/97636602-2dd0-465b-b6dc-acb42147edb3 · Exploit
• https://osv.dev/vulnerability/CVE-2024-6857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6857 · Security Note
• https://t.me/cvetracker/21198 · Telegram Post
• https://twitter.com/CVEnew/status/1909906896611352695 · Twitter Post
• https://t.me/cvedetector/22542 · Telegram Post
• https://t.me/cvenotify/118402 · Telegram Post