CVE-2024-1306
Last modified
CVE-2024-1306 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Rednao | Smart Forms | < 2.6.94 |
References
- https://wpscan.com/vulnerability/c7ce2649-b2b0-43f4-994d-07b1023405e9/Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/c7ce2649-b2b0-43f4-994d-07b1023405e9/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-1306?
How severe is CVE-2024-1306?
How do I fix CVE-2024-1306?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-13054An issue was discovered in GitLab CE/EE affecting all versio…6.5
- CVE-2024-13055The Dyn Business Panel WordPress plugin through 1.0.0 does n…7.1
- CVE-2024-13056The Dyn Business Panel WordPress plugin through 1.0.0 does n…7.1
- CVE-2024-13057The Dyn Business Panel WordPress plugin through 1.0.0 does n…7.1
- CVE-2024-13058An issue exists in SoftIron HyperCloud where authenticated,…4.8
- CVE-2024-13059A vulnerability in mintplex-labs/anything-llm prior to versi…7.2
- CVE-2024-13060A vulnerability in AnythingLLM Docker version 1.3.1 allows u…4.3
- CVE-2024-13061The Electronic Official Document Management System from 2100…9.8
- CVE-2024-13062An unintended entry point vulnerability has been identified …7.2
- CVE-2024-13063Authorization Bypass Through User-Controlled Key vulnerabili…6.8
- CVE-2024-13064Improper Neutralization of Input During Web Page Generation …4.3
- CVE-2024-13065Improper Enforcement of Behavioral Workflow, Uncontrolled Re…6.3
Are you affected by CVE-2024-1306?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST