CVE-2024-6855

MEDIUM

WP MultiTasking < 0.1.12 - Cross-Site Request Forgery in Exit Popup Update

Title source: llm
STIX 2.1

Description

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/1124b07a-6274-49df-be77-615fda8f3a38/

Scores

CVSS v3 4.3
EPSS 0.0020
EPSS Percentile 10.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (1)
ngothang/wp_multitasking < 0.1.12
Published Sep 08, 2024
Tracked Since Feb 18, 2026