CVE-2024-2262 - Vulnerability Details - OpenCVE

Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00167.

Key SSVC decision points have not yet been added.

Vendors	Products
Themify	Woocommerce Product Filter

Configuration 1 [-]

cpe:2.3:a:themify:woocommerce_product_filter:*:*:*:*:*:wordpress:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://wpscan.com/vulnerability/30544377-b90d-4762-b38a-ec89bda0dfdc/

History

Tue, 13 May 2025 01:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Themify Themify woocommerce Product Filter
Weaknesses		CWE-352
CPEs		cpe:2.3:a:themify:woocommerce_product_filter::::::wordpress::*
Vendors & Products		Themify Themify woocommerce Product Filter

Thu, 22 Aug 2024 00:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2024-04-01T05:00:01.688Z

Updated: 2024-08-21T22:39:32.516Z

Reserved: 2024-03-07T14:14:07.699Z

Link: CVE-2024-2262

Vulnrichment

Updated: 2024-08-01T19:03:39.362Z

NVD

Status : Analyzed

Published: 2024-04-01T05:15:07.937

Modified: 2025-05-13T01:01:40.560

Link: CVE-2024-2262

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2262", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2024-03-07T14:14:07.699Z", "datePublished": "2024-04-01T05:00:01.688Z", "dateUpdated": "2024-08-21T22:39:32.516Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-04-01T05:00:01.688Z"}, "title": "WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRF", "problemTypes": [{"descriptions": [{"description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Themify ", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.4.4"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs"}], "references": [{"url": "https://wpscan.com/vulnerability/30544377-b90d-4762-b38a-ec89bda0dfdc/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Erwan LR (WPScan)", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:03:39.362Z"}, "title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/30544377-b90d-4762-b38a-ec89bda0dfdc/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}]}, {"affected": [{"vendor": "themify", "product": "woocommerce_product_filter", "cpes": ["cpe:2.3:a:themify:woocommerce_product_filter:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.4.4", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-04-02T14:52:19.189219Z", "id": "CVE-2024-2262", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T22:39:32.516Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/30544377-b90d-4762-b38a-ec89bda0dfdc/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:03:39.362Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-2262", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-02T14:52:19.189219Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:themify:woocommerce_product_filter:*:*:*:*:*:*:*:*"], "vendor": "themify", "product": "woocommerce_product_filter", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.4", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T22:39:28.883Z"}}], "cna": {"title": "WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRF", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Erwan LR (WPScan)"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Themify ", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/30544377-b90d-4762-b38a-ec89bda0dfdc/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-04-01T05:00:01.688Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2262", "state": "PUBLISHED", "dateUpdated": "2024-08-21T22:39:32.516Z", "dateReserved": "2024-03-07T14:14:07.699Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2024-04-01T05:00:01.688Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}