CVE-2024-39678 WordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDs
An attacker can trick authenticated users into performing unintended actions to retrieve recipe IDs via CSRF in the Cooked WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-39678?
CVE-2024-39678 is a medium-severity vulnerability in XjSv Cooked, published on 17 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-352
Which versions are affected by CVE-2024-39678?
It affects 1 product.
Products include Boxystudio Cooked.
How do I fix CVE-2024-39678?
No fix has been published for CVE-2024-39678 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-39678 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39678 exists.
Other vulnerabilities in XjSv Cooked
- CVE-2022-3900 Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection
- CVE-2023-44477 WordPress Cooked Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-39682 WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt
- CVE-2021-24233 Cooked Pro < 1.7.5.6 - Unauthenticated Reflected Cross Site Scripting (XSS)
- CVE-2024-41816 WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode
Sources
Also known as GHSA-pp3h-ghxf-r9pc.