CVE-2024-3476
Last modified
CVE-2024-3476 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wow-Company | Side Menu Lite | < 4.2.1 |
References
- https://wpscan.com/vulnerability/46f74493-9082-48b2-90bc-2c1d1db64ccd/Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/46f74493-9082-48b2-90bc-2c1d1db64ccd/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-3476?
How severe is CVE-2024-3476?
How do I fix CVE-2024-3476?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-34754Exposure of Sensitive Information to an Unauthorized Actor v…5.3
- CVE-2024-34755Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks…4.3
- CVE-2024-34756Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks…4.3
- CVE-2024-34757Improper Neutralization of Input During Web Page Generation …5.4
- CVE-2024-34758Missing Authorization vulnerability in Wpmet WP Fundraising …5.3
- CVE-2024-34759Improper Neutralization of Input During Web Page Generation …5.4
- CVE-2024-34760Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2024-34761Vulnerability discovered by executing a planned security aud…8.5
- CVE-2024-34762Vulnerability discovered by executing a planned security aud…9.9
- CVE-2024-34763Missing Authorization vulnerability in Saleswonder Team: Tob…5.3
- CVE-2024-34764Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2024-34765Improper Neutralization of Input During Web Page Generation …6.5
Are you affected by CVE-2024-3476?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST