The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is due to missing or incorrect nonce validation on the enableOptimization function. This makes it possible for unauthenticated attackers to enable image optimization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS
No CVSS.
References
Configurations
Configuration 1 (hide)
|
History
31 Dec 2024, 16:48
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Imagerecycle
Imagerecycle imagerecycle Pdf \& Image Compression |
|
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/0318ec4a-185a-405d-90f8-008ba373114b?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/changeset/3031424/imagerecycle-pdf-image-compression - Product | |
| CPE | cpe:2.3:a:imagerecycle:imagerecycle_pdf_\&_image_compression:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-352 |
29 Feb 2024, 01:43
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-29 01:43
Updated : 2024-12-31 16:48
NVD link : CVE-2024-1334
Mitre link : CVE-2024-1334
JSON object : View
Products Affected
imagerecycle
- imagerecycle_pdf_\&_image_compression
CWE
CWE-352
Cross-Site Request Forgery (CSRF)