PT-2025-2483 · Uncanny Owl · Uncanny Toolkit For Learndash

Dave Jong · Published 2025-01-02 · Updated 2025-01-02 · CVE-2024-37438

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Uncanny Toolkit Pro for LearnDash versions prior to 4.1.4.1

Description: The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthorized actions to be performed on behalf of a user. This can lead to various security problems, including data modification or unauthorized access to sensitive information. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations: For versions prior to 4.1.4.1, update to version 4.1.4.1 or later to resolve the issue. As a temporary workaround, consider implementing additional security measures to prevent CSRF attacks, such as validating user requests and ensuring that all requests include a valid token. Restrict access to sensitive functionality to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-37438

Affected Products

Uncanny Toolkit For Learndash

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-37438 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/uncanny-toolkit-pro/vulnerability/wordpress-uncanny-toolkit-pro-for-learndash-plugin-4-1-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/14156 · Telegram Post
• https://patchstack.com/database/wordpress/plugin/uncanny-toolkit-pro/vulnerability/wordpress-uncanny-toolkit-pro-for-learndash-plugin-4-1-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1874830609664868826 · Twitter Post