CVE-2024-5167 Cross-site request forgery in CM Email Registration Blacklist and Whitelist
Attackers can trick admins into modifying email blacklist and whitelist settings via CSRF, requiring an upgrade to the plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-5167?
CVE-2024-5167 is a high-severity vulnerability in Unknown CM Email Registration Blacklist and Whitelist, published on 13 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item from the blacklist or whitelist, which could allow attackers to make a logged in admin add or delete settings from the blacklist or whitelist menu via a CSRF attack
Weakness: CWE-352
Which versions are affected by CVE-2024-5167?
It affects 1 product.
Products include Cminds Cm E-Mail Blacklist.
How do I fix CVE-2024-5167?
No fix has been published for CVE-2024-5167 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-5167 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-5167 exists.
Sources
Also known as GHSA-cwpg-2qv7-g34j.