CVE-2024-12383

The Binary MLM Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'bmw_display_pv_set_page' function and insufficient input sanitization and output escaping of the 'product_points' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/woo-binary-mlm/trunk/includes/admin/point_setting.php#L7
• https://plugins.trac.wordpress.org/browser/woo-binary-mlm/trunk/includes/admin/point_setting.php#L92
• https://plugins.trac.wordpress.org/browser/woo-binary-mlm/trunk/includes/admin/point_setting.php#L96
• https://plugins.trac.wordpress.org/changeset/3418912/woo-binary-mlm/trunk/includes/admin/point_setting.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b061fbf2-4bb3-4ccc-ba90-1e947365435e?source=cve

Published

Jan 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12378On affected platforms running Arista EOS with secure Vxlan c…9.1
• CVE-2024-12379A denial of service vulnerability in GitLab CE/EE affecting …6.5
• CVE-2024-1238The ElementsKit Elementor addons plugin for WordPress is vul…5.4
• CVE-2024-12380An issue was discovered in GitLab EE/CE affecting all versio…7.5
• CVE-2024-12381Type Confusion in V8 in Google Chrome prior to 131.0.6778.13…8.8
• CVE-2024-12382Use after free in Translate in Google Chrome prior to 131.0.…8.8
• CVE-2024-12384The Binary MLM Woocommerce plugin for WordPress is vulnerabl…6.1
• CVE-2024-12385The WP Abstracts plugin for WordPress is vulnerable to Cross…6.1
• CVE-2024-12386The WP Abstracts plugin for WordPress is vulnerable to Cross…5.4
• CVE-2024-12387A vulnerability in the binary-husky/gpt_academic repository,…6.5
• CVE-2024-12388A vulnerability in binary-husky/gpt_academic version 310122f…6.5
• CVE-2024-12389A path traversal vulnerability exists in binary-husky/gpt_ac…8.8