PT-2025-2482 · Rara Theme · Rara Theme Perfect Portfolio

Dhabaleshwar Das · Published 2025-01-02 · Updated 2026-01-08 · CVE-2024-37435

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Rara Theme Perfect Portfolio versions 1.2.0 and earlier

Description: The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into performing an unintended action on the web application.

Recommendations: For Rara Theme Perfect Portfolio versions 1.2.0 and earlier, update to a version that includes a fix for this issue, if available. As a temporary workaround, consider implementing additional validation and verification measures for requests to prevent unauthorized actions. Restrict access to sensitive functionality to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-37435

Affected Products

Rara Theme Perfect Portfolio

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-37435 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37435 · Vendor Advisory
• https://t.me/cveNotify/148071 · Telegram Post
• https://patchstack.com/database/wordpress/theme/perfect-portfolio/vulnerability/wordpress-perfect-portfolio-theme-1-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1874794007319998466 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/perfect-portfolio/vulnerability/wordpress-perfect-portfolio-theme-1-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note