CVE-2024-2395

The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.14. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to generate and delete labels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-862
• CWE-352

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034198%40bulgarisation-for-woocommerce&new=3034198%40bulgarisation-for-woocommerce&sfp_email=&sfph_mail=Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff1d12e-1129-40d3-8c29-3a46ffc77872?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034198%40bulgarisation-for-woocommerce&new=3034198%40bulgarisation-for-woocommerce&sfp_email=&sfph_mail=Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff1d12e-1129-40d3-8c29-3a46ffc77872?source=cveThird Party Advisory

Published

Mar 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23944Information disclosure in persistent watchers handling in Ap…5.3
• CVE-2024-23945Signing cookies is an application security feature that adds…5.9
• CVE-2024-23946Possible path traversal in Apache OFBiz allowing file inclus…5.3
• CVE-2024-23947Multiple improper array index validation vulnerabilities exi…8.8
• CVE-2024-23948Multiple improper array index validation vulnerabilities exi…8.8
• CVE-2024-23949Multiple improper array index validation vulnerabilities exi…8.8
• CVE-2024-23950Multiple improper array index validation vulnerabilities exi…8.8
• CVE-2024-23951Multiple improper array index validation vulnerabilities exi…8.8
• CVE-2024-23952This is a duplicate for CVE-2023-46104. With correct CVE ver…6.5
• CVE-2024-23953Use of Arrays.equals() in LlapSignerImpl in Apache Hive to c…6.5
• CVE-2024-23957Autel MaxiCharger AC Elite Business C50 DLB_HostHeartBeat St…8.8
• CVE-2024-23958Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Creden…8.8