CVE-2021-24696CWE-352

Simple Download Monitor < 3.9.9 - Multiple CSRF

published January 24, 2022

CVSS
—
EPSS
1%
Percentile
49.6
In the wild
Unconfirmed
What it is

The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00630 · 49.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-01-24T08:00Z
EPSS history
Timeline
  • 24 JAN 08:00Z
    Simple Download Monitor < 3.9.9 - Multiple CSRF
    cvelistv5