CVE-2024-39678

MEDIUM

Cooked < 1.8.0 - Cross-Site Request Forgery via AJAX Action Handler

Title source: llm

Description

Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References (1)

Core 1

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/XjSv/Cooked/security/advisories/GHSA-pp3h-ghxf-r9pc

Scores

CVSS v3 4.3

EPSS 0.0034

EPSS Percentile 26.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-352

Status published

Products (1)

boxystudio/cooked < 1.8.0

Published Jul 18, 2024

Tracked Since Feb 18, 2026