CVE-2024-1538
CVE-2024-1538 is a Cross-Site Request Forgery (CSRF) vulnerability found in the File Manager plugin for WordPress, affecting versions up to 7.2.4. This vulnerability allows unauthenticated attackers to potentially achieve Remote Code Execution (RCE). The flaw stems from missing or inadequate nonce validation on the 'wp_file_manager' page, specifically when including files through the 'lang' parameter. While the CVSS score is 0, the SOCRadar Vulnerability Risk Score (SVRS) of 36, combined with the "In The Wild" tag, indicates a need for awareness and monitoring. Although a score of 36 is not critical, the active exploitation of this vulnerability highlights the importance of promptly updating to version 7.2.5 or later to mitigate the security risk. This vulnerability is significant because it can lead to complete compromise of the WordPress site if an administrator is tricked into clicking a malicious link, emphasizing the importance of user awareness and vigilance.
Description
CVE-2024-1538 is a Cross-Site Request Forgery (CSRF) vulnerability in the File Manager plugin for WordPress versions up to 7.2.4. It allows unauthenticated attackers to include local JavaScript files that can be used to achieve Remote Code Execution (RCE) by tricking a site administrator into clicking on a malicious link.
Key Insights
- High Severity: The CVSS score of 8.8 indicates a high severity vulnerability.
- SVRS of 30: The SOCRadar Vulnerability Risk Score (SVRS) of 30 suggests a moderate risk, indicating that the vulnerability is not as critical as those with SVRS scores above 80.
- Exploited in the Wild: This vulnerability is actively exploited by hackers, making it crucial to take immediate action.
Mitigation Strategies
- Update the File Manager plugin to version 7.2.5 or later.
- Implement CSRF protection measures on the affected website.
- Educate site administrators about the risks of CSRF attacks and how to avoid them.
- Monitor the website for suspicious activity and take appropriate action if necessary.
Additional Information
- Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
- CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.