sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-10521 WordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function

Medium 4.3 Published Updated

Unauthenticated attackers can delete forms by tricking administrators into clicking a link due to missing nonce validation in the Contact Forms by Cimatti plugin.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
A user has to click or open something
Fix
None listed

What is CVE-2024-10521?

CVE-2024-10521 is a medium-severity vulnerability in Contact Forms by Cimatti, published on 27 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to delete forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2024-10521?

It affects 1 product.

Products include Cimatti Wordpress Contact Forms.

How do I fix CVE-2024-10521?

No fix has been published for CVE-2024-10521 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-10521 being exploited?

There is no known exploitation of CVE-2024-10521 in the wild and no public exploit code.

Sources

Also known as GHSA-9hf2-v2rp-2vp6.

Is CVE-2024-10521 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free