CVE-2024-0790

The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8.1. This is due to missing or incorrect nonce validation on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions. This makes it possible for unauthenticated attackers to create, modify and delete taxonomy terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Furthermore, the functions wpbe_save_options, wpbe_bulk_delete_posts_count, wpbe_bulk_delete_posts, and wpbe_save_meta are vulnerable to Cross-Site Request Forgery allowing for plugin options update, post count deletion, post deletion and modification of post metadata via forged request.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/bulk-editor/trunk/index.phpProduct
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3028699%40bulk-editor%2Ftrunk&old=3012874%40bulk-editor%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6c48f94b-d193-429a-9383-628ae12bfdf3?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/bulk-editor/trunk/index.phpProduct
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3028699%40bulk-editor%2Ftrunk&old=3012874%40bulk-editor%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6c48f94b-d193-429a-9383-628ae12bfdf3?source=cveThird Party Advisory

Published

Feb 5, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0783A vulnerability was found in Project Worlds Online Admission…9.8
• CVE-2024-0784A vulnerability was found in hongmaple octopus 1.0. It has b…9.8
• CVE-2024-0786The Conversios – Google Analytics 4 (GA4), Meta Pixel & more…6.5
• CVE-2024-0787phpIPAM version 1.5.1 contains a vulnerability where an atta…5.9
• CVE-2024-0788SUPERAntiSpyware Pro X v10.0.1260 is vulnerable to kernel-le…6.6
• CVE-2024-0789The WP Maintenance plugin for WordPress is vulnerable to IP …5.3
• CVE-2024-0791The WOLF – WordPress Posts Bulk Editor and Manager Professio…4.3
• CVE-2024-0792The WP Shortcodes Plugin — Shortcodes Ultimate plugin for Wo…5.4
• CVE-2024-0793A flaw was found in kube-controller-manager. This issue occu…7.7
• CVE-2024-0794Certain HP LaserJet Pro, HP Enterprise LaserJet, and HP Lase…9.8
• CVE-2024-0795If an attacked was given access to an instance with the admi…7.2
• CVE-2024-0796The Active Products Tables for WooCommerce. Professional pro…4.3