CVE-2021-24799CWE-352

Far Future Expiry Header < 1.5 - Plugin's Settings Update via CSRF

published November 1, 2021

CVSS
—
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00468 · 39.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-11-01T08:46Z
EPSS history
Timeline
  • 01 NOV 08:46Z
    Far Future Expiry Header < 1.5 - Plugin's Settings Update via CSRF
    cvelistv5