CVE-2021-24809CWE-352

BP Better Messages < 1.9.9.41 - Multiple CSRF

published November 1, 2021

CVSS
—
EPSS
1%
Percentile
53.3
In the wild
Unconfirmed
What it is

The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00726 · 53.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-11-01T08:46Z
EPSS history
Timeline
  • 01 NOV 08:46Z
    BP Better Messages < 1.9.9.41 - Multiple CSRF
    cvelistv5