CVE-2024-9598 AMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation

What is CVE-2024-9598?

CVE-2024-9598 is a high-severity vulnerability in mohammed_kaludi AMP for WP – Accelerated Mobile Pages, published on 25 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This is due to missing or incorrect nonce validation on the 'proxy' function. This makes it possible for unauthenticated attackers to send the logged in user's cookies to their own server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2024-9598?

It affects 1 product.

Products include Ampforwp Accelerated Mobile Pages.

How do I fix CVE-2024-9598?

No fix has been published for CVE-2024-9598 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-9598 being exploited?

There is no known exploitation of CVE-2024-9598 in the wild and no public exploit code.

Other vulnerabilities in mohammed_kaludi AMP for WP – Accelerated Mobile Pages

• CVE-2024-1043 AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data Medium 6.5
• CVE-2024-6896 Cross-site scripting in AMP for WP – Accelerated Mobile Pages Medium 6.4
• CVE-2024-11254 AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting Medium 6.1
• CVE-2024-0587 Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting Medium 6.1
• CVE-2021-23150 Cross-site scripting in AMP for WP – Accelerated Mobile Pages (WordPress plugin) Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qr32-hx8f-hm76.