CVE-2024-0379
MEDIUMCustom Twitter Feeds < 2.2.1 - Cross-Site Request Forgery via ctf_auto_save_tokens Function
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-0379. PoCs published by kodaichodai.
AI-analyzed exploit summary This is a functional CSRF PoC for CVE-2024-0379, targeting a WordPress admin-ajax.php endpoint with a crafted form submission. The exploit leverages a missing CSRF token validation to perform unauthorized actions via the 'ctf_auto_save_tokens' action.
Description
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the ctf_auto_save_tokens function. This makes it possible for unauthenticated attackers to update the site's twitter API token and secret via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Exploits (1)
This is a functional CSRF PoC for CVE-2024-0379, targeting a WordPress admin-ajax.php endpoint with a crafted form submission. The exploit leverages a missing CSRF token validation to perform unauthorized actions via the 'ctf_auto_save_tokens' action.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N