CVE-2024-11415

The WP-Orphanage Extended plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the wporphanageex_menu_settings() function. This makes it possible for unauthenticated attackers to escalate the privileges of all orphan accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/wp-orphanage-extended/trunk/wp-orphanage-extended-options.php
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3194570%40wp-orphanage-extended&new=3194570%40wp-orphanage-extended&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ed6255-d8df-4f57-961b-1a0c21e352ac?source=cve

Published

Nov 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1141A vulnerability was found in python-glance-store. The issue …5.5
• CVE-2024-11410The Top and footer bars for announcements, notifications, ad…6.4
• CVE-2024-11411The Spotlightr plugin for WordPress is vulnerable to Stored …6.4
• CVE-2024-11412The Shine PDF Embeder plugin for WordPress is vulnerable to …6.4
• CVE-2024-11413The HostFact bestelformulier integratie plugin for WordPress…6.4
• CVE-2024-11414The RecipePress Reloaded plugin for WordPress is vulnerable …6.4
• CVE-2024-11416The WIP Incoming Lite plugin for WordPress is vulnerable to …6.1
• CVE-2024-11417The dejure.org Vernetzungsfunktion plugin for WordPress is v…6.1
• CVE-2024-11418The Additional Order Filters for WooCommerce plugin for Word…6.1
• CVE-2024-11419The Password for WP plugin for WordPress is vulnerable to Cr…6.1
• CVE-2024-1142Path Traversal in Sonatype IQ Server from version 143 allows…5.4
• CVE-2024-11420The Blocksy theme for WordPress is vulnerable to Stored Cros…5.4