CVE-2024-41597 ProcessWire Cross Site Request Forgery vulnerability

Medium 4.2 Published 19 Jul 2024 Updated 9 Jul 2026

A remote attacker could potentially insert comments via CSRF, though the vendor disputes this due to anonymous comment features and moderation defaults.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-41597?

CVE-2024-41597 is a medium-severity vulnerability in n/a, published on 19 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situations in which CSRF would be a useful attack technique. Also, the submitted comments are, by default, held for moderator review.

Weakness: CWE-352

Which versions are affected by CVE-2024-41597?

2 open source packages ship an affected version, including processwire/processwire. It affects 1 product.

Package	Affected	Fixed in
`processwire/processwire` Packagist	All versions to `3.0.229`	None
`processwire/processwire` Packagist	All versions to `3.0.229`	None

Products include Processwire Processwire.

How do I fix CVE-2024-41597?

No fix has been published for CVE-2024-41597 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-41597 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-41597 exists.

Sources

Also known as GHSA-r9vw-cjf9-xh4x.