CVE-2024-12291

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12291
The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.17. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227785%40viewmedica&new=3227785%40viewmedica&sfp_email=&sfph_mail=
https://wordpress.org/plugins/viewmedica/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/646ba700-28d5-455f-88de-2864ef8f202c?source=cve
Configurations

No configuration.

History

08 Apr 2026, 18:19

Type Values Removed Values Added
Summary
  • (es) El complemento ViewMedica 9 para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 1.4.15 incluida. Esto se debe a la falta o la validación incorrecta de un nonce en una función. Esto hace posible que atacantes no autenticados inyecten web scripts maliciosos a través de una solicitud falsificada, siempre que puedan engañar al administrador del sitio para que realice una acción como hacer clic en un enlace.
Summary (en) The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.15. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. (en) The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.17. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
  • () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227785%40viewmedica&new=3227785%40viewmedica&sfp_email=&sfph_mail= -

07 Jan 2025, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-07 05:15

Updated : 2026-06-17 06:59

NVD link : CVE-2024-12291

Mitre link : CVE-2024-12291

CVE.ORG link : CVE-2024-12291

JSON object : View

Products Affected

No product.

CWE
CWE-352

Cross-Site Request Forgery (CSRF)