CVE-2024-5943CWE-352

Nested Pages <= 3.2.7 - Cross-Site Request Forgery to Local File Inclusion

High · published July 4, 2024

CVSS v3.1
8.8
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due to missing or incorrect nonce validation on the 'settingsPage' function and missing santization of the 'tab' parameter. This makes it possible for unauthenticated attackers to call local php files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00295 · 21.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2024-07-04T11:34Z
EPSS history
Timeline
  • 04 JUL 11:34Z
    Nested Pages <= 3.2.7 - Cross-Site Request Forgery to Local File Inclusion
    cvelistv5