Login Request a demo
Medium severity · published Jul 24, 2024
CVE-2024-6751
Social Auto Poster <= 5.3.14 - Cross-Site Request Forgery via Multiple Functions
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Social Auto Poster · WPWeb
through 5.3.14 · source: vendor, NVD
Affected product
SA
Social Auto Poster
WPWeb
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6751
Product
https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/d7aceccc-7004-42f2-b085-eade9c45141c?source=cve
More from Social Auto Poster
8.8
CVE-2024-49272
WordPress Social Auto Poster plugin <= 5.3.15 - Cross Site Request Forgery (CSRF) vulnerability
8.8
CVE-2024-6756
Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload
7.5
CVE-2024-6750
Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions
6.1
CVE-2024-47369
WordPress Social Auto Poster plugin <= 5.3.15 - Reflected Cross Site Scripting (XSS) vulnerability
6.1
CVE-2024-6753
Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting