{"id":"CVE-2024-3478","state":"PUBLISHED","title":"Herd Effects < 5.2.7 - Effect Deletion via CSRF","description":"The Herd Effects  WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks","publishedAt":"2024-05-02T06:00:03.481Z","updatedAt":"2025-03-25T18:22:51.484Z","severity":{"score":6.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Herd Effects "],"affected":[{"vendor":"Unknown","product":"Herd Effects ","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.2.7","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/09f1a696-86ee-47cc-99de-57cfd2a3219d/"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/3xxx/CVE-2024-3478.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-3478","state":"PUBLISHED","datePublished":"2024-05-02T06:00:03.481Z","dateUpdated":"2025-03-25T18:22:51.484Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2024-04-08T18:34:03.327Z"},"containers":{"cna":{"title":"Herd Effects < 5.2.7 - Effect Deletion via CSRF","descriptions":[{"lang":"en","value":"The Herd Effects  WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks"}],"affected":[{"vendor":"Unknown","product":"Herd Effects ","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.2.7","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/09f1a696-86ee-47cc-99de-57cfd2a3219d/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2024-05-02T06:00:03.481Z"},"credits":[{"lang":"en","value":"Bob Matyas","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.1,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-03-25T18:21:56.925217Z","id":"CVE-2024-3478","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-25T18:22:51.484Z"}},{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/09f1a696-86ee-47cc-99de-57cfd2a3219d/","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:12:07.350Z"}}]}}}