Vulnerability Details CVE-2024-1360
The Colibri WP theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.94. This is due to missing or incorrect nonce validation on the colibriwp_install_plugin() function. This makes it possible for unauthenticated attackers to install recommended plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 27.0%
CVSS Severity
CVSS v3 Score 4.3
References
- https://themes.trac.wordpress.org/changeset/218308/colibri-wp/1.0.101/inc/src/PluginsManager.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/db56844f-9988-4f6a-ba1d-f190ff009f2b?source=cve
- https://themes.trac.wordpress.org/changeset/218308/colibri-wp/1.0.101/inc/src/PluginsManager.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/db56844f-9988-4f6a-ba1d-f190ff009f2b?source=cve
Products affected by CVE-2024-1360
-
cpe:2.3:a:colibriwp:colibri:-
-
cpe:2.3:a:colibriwp:colibri:1.0.102
-
cpe:2.3:a:colibriwp:colibri:1.0.105
-
cpe:2.3:a:colibriwp:colibri:1.0.107
-
cpe:2.3:a:colibriwp:colibri:1.0.109
-
cpe:2.3:a:colibriwp:colibri:1.0.125
-
cpe:2.3:a:colibriwp:colibri:1.0.137
-
cpe:2.3:a:colibriwp:colibri:1.0.20
-
cpe:2.3:a:colibriwp:colibri:1.0.21
-
cpe:2.3:a:colibriwp:colibri:1.0.30
-
cpe:2.3:a:colibriwp:colibri:1.0.31
-
cpe:2.3:a:colibriwp:colibri:1.0.35
-
cpe:2.3:a:colibriwp:colibri:1.0.44
-
cpe:2.3:a:colibriwp:colibri:1.0.49
-
cpe:2.3:a:colibriwp:colibri:1.0.53
-
cpe:2.3:a:colibriwp:colibri:1.0.60
-
cpe:2.3:a:colibriwp:colibri:1.0.61
-
cpe:2.3:a:colibriwp:colibri:1.0.72
-
cpe:2.3:a:colibriwp:colibri:1.0.77
-
cpe:2.3:a:colibriwp:colibri:1.0.78
-
cpe:2.3:a:colibriwp:colibri:1.0.80
-
cpe:2.3:a:colibriwp:colibri:1.0.81
-
cpe:2.3:a:colibriwp:colibri:1.0.82
-
cpe:2.3:a:colibriwp:colibri:1.0.86
-
cpe:2.3:a:colibriwp:colibri:1.0.87
-
cpe:2.3:a:colibriwp:colibri:1.0.88
-
cpe:2.3:a:colibriwp:colibri:1.0.89
-
cpe:2.3:a:colibriwp:colibri:1.0.92
-
cpe:2.3:a:colibriwp:colibri:1.0.93
-
cpe:2.3:a:colibriwp:colibri:1.0.94
-
cpe:2.3:a:colibriwp:colibri:1.0.99