CVE-2024-8490

The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'save_account_details' function. This makes it possible for unauthenticated attackers to edit the name, email address, and password of an administrator account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/propertyhive/tags/2.0.19/includes/class-ph-ajax.php#L1089Product
• https://plugins.trac.wordpress.org/browser/propertyhive/tags/2.0.19/includes/class-ph-ajax.php#L976Product
• https://plugins.trac.wordpress.org/changeset/3152548/Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/17c06c83-6707-4233-a1c3-ef4cdcf93982?source=cveThird Party Advisory

Published

Sep 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8484The REST API TO MiniProgram plugin for WordPress is vulnerab…7.5
• CVE-2024-8485The REST API TO MiniProgram plugin for WordPress is vulnerab…9.8
• CVE-2024-8486The Shortcodes and extra features for Phlox theme plugin for…5.4
• CVE-2024-8487A Cross-Origin Resource Sharing (CORS) vulnerability exists …9.8
• CVE-2024-8488The Survey Maker plugin for WordPress is vulnerable to Store…4.8
• CVE-2024-8489A vulnerability in modelscope/agentscope, specifically in th…8.8
• CVE-2024-8491Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-8492The Hustle WordPress plugin through 7.8.5 does not sanitise…4.8
• CVE-2024-8493The Events Calendar WordPress plugin before 6.6.4 does not s…4.8
• CVE-2024-8494The Elementor Website Builder Pro plugin for WordPress is vu…6.5
• CVE-2024-8495A null pointer dereference in Ivanti Connect Secure before v…7.5
• CVE-2024-8496Under specific circumstances, insecure permissions in Ivanti…7.8