CVE-2024-0623

MEDIUM

VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery via vbp_clear_patterns_cache()

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-0623. PoCs published by kodaichodai.

AI-analyzed exploit summary This is a functional CSRF PoC for CVE-2024-0623, targeting WordPress admin-ajax.php with a crafted GET request to trigger the vulnerability. The exploit manipulates the action parameter to clear patterns cache, demonstrating the flaw.

Description

The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing or incorrect nonce validation on the vbp_clear_patterns_cache() function. This makes it possible for unauthenticated attackers to clear the patterns cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Exploits (1)

nomisec WORKING POC
by kodaichodai · poc
https://github.com/kodaichodai/CVE-2024-0623

This is a functional CSRF PoC for CVE-2024-0623, targeting WordPress admin-ajax.php with a crafted GET request to trigger the vulnerability. The exploit manipulates the action parameter to clear patterns cache, demonstrating the flaw.

Classification
Working Poc 90%
Attack Type
Csrf
Complexity
Trivial
Reliability
Reliable
Target: WordPress (specific version not specified)
No auth needed
Prerequisites: Victim must be authenticated as admin and visit the malicious page
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 4.3
EPSS 0.0067
EPSS Percentile 47.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (2)
vektor-inc/VK Block Patterns < 1.31.1.1
vektor-inc/vk_block_patterns < 1.31.1.1
Published Jan 20, 2024
Tracked Since Feb 18, 2026