Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/30544377-b90d-4762-b38a-ec89bda0dfdc/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/30544377-b90d-4762-b38a-ec89bda0dfdc/ | Exploit Third Party Advisory |
Configurations
History
13 May 2025, 01:01
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-352 | |
| First Time |
Themify
Themify woocommerce Product Filter |
|
| References | () https://wpscan.com/vulnerability/30544377-b90d-4762-b38a-ec89bda0dfdc/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:themify:woocommerce_product_filter:*:*:*:*:*:wordpress:*:* |
21 Nov 2024, 09:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/30544377-b90d-4762-b38a-ec89bda0dfdc/ - |
21 Aug 2024, 23:35
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
01 Apr 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-01 05:15
Updated : 2025-05-13 01:01
NVD link : CVE-2024-2262
Mitre link : CVE-2024-2262
CVE.ORG link : CVE-2024-2262
JSON object : View
Products Affected
themify
- woocommerce_product_filter
CWE
CWE-352
Cross-Site Request Forgery (CSRF)